Mir100 Firmware
CVE-2020-10275
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.
AnalysisAI
The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-261. The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data. Affected products include: Mobile-Industrial-Robots Mir100 Firmware, Mobile-Industrial-Robots Mir200 Firmware, Mobile-Industrial-Robots Mir250 Firmware, Mobile-Industrial-Robots Mir500 Firmware, Mobile-Industrial-Robots Mir1000 Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Mir100 Firmware
View allMiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational gra
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational gra
Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to a
MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop us
The password for the safety PLC is the default and thus easy to find (in manuals, etc.). Rated critical severity (CVSS 9
One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles com
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, eff
MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual proper
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of se
The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings suc
Same weakness CWE-261 – Weak Encoding for Password
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today