Mir100 Firmware
CVE-2020-10269
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in WiFi Master (Access Point) mode. Credentials to such wireless Access Point default to well known and widely spread SSID (MiR_RXXXX) and passwords (omitted). This information is also available in past User Guides and manuals which the vendor distributed. We have confirmed this flaw in MiR100 and MiR200 but it might also apply to MiR250, MiR500 and MiR1000.
AnalysisAI
One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in WiFi Master (Access Point) mode. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in WiFi Master (Access Point) mode. Credentials to such wireless Access Point default to well known and widely spread SSID (MiR_RXXXX) and passwords (omitted). This information is also available in past User Guides and manuals which the vendor distributed. We have confirmed this flaw in MiR100 and MiR200 but it might also apply to MiR250, MiR500 and MiR1000. Affected products include: Aliasrobotics Mir100 Firmware, Aliasrobotics Mir200 Firmware, Aliasrobotics Mir250 Firmware, Aliasrobotics Mir500 Firmware, Aliasrobotics Mir1000 Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.
More in Mir100 Firmware
View allMiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational gra
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational gra
Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to a
MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop us
The password for the safety PLC is the default and thus easy to find (in manuals, etc.). Rated critical severity (CVSS 9
The access tokens for the REST API are directly derived from the publicly available default credentials for the web inte
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, eff
MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual proper
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of se
The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings suc
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today