CVE-2020-10272 RVD#2554: MiR ROS computational graph presents no authentication mechanisms

Critical 10.0 Published 24 Jun 2020 Updated 17 Sep 2024

Attackers on the network can control MiR robots because the ROS computational graph lacks authentication mechanisms.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-10272?

CVE-2020-10272 is a critical missing authorization vulnerability in Mobile Industrial Robots A/S MiR100, published on 24 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire.

Weakness: CWE-306

Which versions are affected by CVE-2020-10272?

It affects 10 products.

Products include Aliasrobotics Mir1000 Firmware, Aliasrobotics Mir100 Firmware, Aliasrobotics Mir200 Firmware, Aliasrobotics Mir250 Firmware, Aliasrobotics Mir500 Firmware, Enabled-Robotics Er-Flex Firmware and 4 more.

How do I fix CVE-2020-10272?

No fix has been published for CVE-2020-10272 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-10272 being exploited?

There is no known exploitation of CVE-2020-10272 in the wild and no public exploit code.

Sources

Also known as GHSA-2wvf-vp7x-88v4.