CVE-2020-10273 RVD#2560: Unprotected intellectual property in Mobile Industrial Robots (MiR) controllers
Attackers with network or physical access can retrieve unencrypted intellectual property and data from MiR robot controllers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10273?
CVE-2020-10273 is a high-severity vulnerability in Mobile Industrial Robots A/S MiR100, published on 24 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual property artifacts installed in the robots. This flaw allows attackers with access to the robot or the robot network (while in combination with other flaws) to retrieve and easily exfiltrate all installed intellectual property and data.
Which versions are affected by CVE-2020-10273?
It affects 10 products.
Products include Aliasrobotics Mir1000 Firmware, Aliasrobotics Mir100 Firmware, Aliasrobotics Mir200 Firmware, Aliasrobotics Mir250 Firmware, Aliasrobotics Mir500 Firmware, Enabled-Robotics Er-Flex Firmware and 4 more.
How do I fix CVE-2020-10273?
No fix has been published for CVE-2020-10273 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-10273 being exploited?
There is no known exploitation of CVE-2020-10273 in the wild and no public exploit code.
Other vulnerabilities in Mobile Industrial Robots A/S MiR100
- CVE-2020-10271 Misconfiguration in MiR100
- CVE-2020-10272 RVD#2554: MiR ROS computational graph presents no authentication mechanisms
- CVE-2020-10279 RVD#2569: Insecure operating system defaults in MiR robots
- CVE-2020-10269 RVD#2566: Hardcoded Credentials on MiRX00 wireless Access Point
- CVE-2020-10270 RVD#2557: Hardcoded Credentials on MiRX00 Control Dashboard
Sources
Also known as GHSA-xcg4-2whc-8q87.