Mir100 Firmware
CVE-2020-10272
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire.
AnalysisAI
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Missing Authentication for Critical Function (CWE-306), which allows attackers to access critical functionality without authentication. MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire. Affected products include: Aliasrobotics Mir100 Firmware, Aliasrobotics Mir200 Firmware, Aliasrobotics Mir250 Firmware, Aliasrobotics Mir500 Firmware, Aliasrobotics Mir1000 Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Require authentication for all sensitive operations, implement defense in depth.
More in Mir100 Firmware
View allMiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational gra
Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to a
MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop us
The password for the safety PLC is the default and thus easy to find (in manuals, etc.). Rated critical severity (CVSS 9
The access tokens for the REST API are directly derived from the publicly available default credentials for the web inte
One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles com
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, eff
MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual proper
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of se
The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings suc
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today