Mir100 Firmware
CVE-2020-10276
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the laser scanner are not affected (thus it is hard to detect before something happens) though the laser scanner configuration can also be affected altering further the safety of the device.
AnalysisAI
The password for the safety PLC is the default and thus easy to find (in manuals, etc.). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the laser scanner are not affected (thus it is hard to detect before something happens) though the laser scanner configuration can also be affected altering further the safety of the device. Affected products include: Mobile-Industrial-Robots Mir100 Firmware, Mobile-Industrial-Robots Mir200 Firmware, Mobile-Industrial-Robots Mir250 Firmware, Mobile-Industrial-Robots Mir500 Firmware, Mobile-Industrial-Robots Mir1000 Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.
More in Mir100 Firmware
View allMiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational gra
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational gra
Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to a
MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop us
The access tokens for the REST API are directly derived from the publicly available default credentials for the web inte
One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles com
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, eff
MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual proper
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of se
The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings suc
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today