CVE-2020-10270 RVD#2557: Hardcoded Credentials on MiRX00 Control Dashboard
Attackers can remotely control MiR robots using hardcoded default credentials on the control dashboard, enabling unauthorized access and potential manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10270?
CVE-2020-10270 is a critical vulnerability in Mobile Industrial Robots A/S MiR100, published on 24 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcoded IP address. Credentials to such wireless interface default to well known and widely spread users (omitted) and passwords (omitted). This information is also available in past User Guides and manuals which the vendor distributed. This flaw allows cyber attackers to take control of the robot remotely and make use of the default user interfaces MiR has created, lowering the complexity of attacks and making them available to entry-level attackers. More elaborated attacks can also be established by clearing authentication and sending network requests directly. We have confirmed this flaw in MiR100 and MiR200 but according to the vendor, it might also apply to MiR250, MiR500 and MiR1000.
Weakness: CWE-798
Which versions are affected by CVE-2020-10270?
It affects 10 products.
Products include Aliasrobotics Mir1000 Firmware, Aliasrobotics Mir100 Firmware, Aliasrobotics Mir200 Firmware, Aliasrobotics Mir250 Firmware, Aliasrobotics Mir500 Firmware, Enabled-Robotics Er-Flex Firmware and 4 more.
How do I fix CVE-2020-10270?
No fix has been published for CVE-2020-10270 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-10270 being exploited?
There is no known exploitation of CVE-2020-10270 in the wild and no public exploit code.
Other vulnerabilities in Mobile Industrial Robots A/S MiR100
- CVE-2020-10271 Misconfiguration in MiR100
- CVE-2020-10272 RVD#2554: MiR ROS computational graph presents no authentication mechanisms
- CVE-2020-10279 RVD#2569: Insecure operating system defaults in MiR robots
- CVE-2020-10269 RVD#2566: Hardcoded Credentials on MiRX00 wireless Access Point
- CVE-2020-10273 RVD#2560: Unprotected intellectual property in Mobile Industrial Robots (MiR) controllers
Sources
Also known as GHSA-3vvj-p2p8-pchq.