Mobile Industrial Robots A/s Mir100
12 CVEs affecting Mobile Industrial Robots A/s Mir100. Latest disclosed: 2020-06-24. Critical: 7, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-10279 | Critical | 9.8 | 2020-06-24 | MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents inse… |
CVE-2020-10276 | Critical | 9.8 | 2020-06-24 | The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, ef… |
CVE-2020-10275 | Critical | 9.8 | 2020-06-24 | The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD… |
CVE-2020-10272 | Critical | 9.8 | 2020-06-24 | MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication… |
CVE-2020-10271 | Critical | 9.8 | 2020-06-24 | MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph to all network interfaces, wireless… |
CVE-2020-10270 | Critical | 9.8 | 2020-06-24 | Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardco… |
CVE-2020-10269 | Critical | 9.8 | 2020-06-24 | One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in WiFi Master (Acces… |
CVE-2020-10280 | High | 7.5 | 2020-06-24 | The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the das… |
CVE-2020-10273 | High | 7.5 | 2020-06-24 | MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual property artifacts installed in the robots. T… |
CVE-2020-10274 | High | 7.1 | 2020-06-24 | The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard… |
CVE-2020-10277 | Medium | 6.4 | 2020-06-24 | There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file)… |
CVE-2020-10278 | Medium | 4.6 | 2020-06-24 | The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order. This can be leveraged… |