Mir100 Firmware
CVE-2020-10277
MEDIUM
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Lifecycle Timeline
1DescriptionNVD
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine.
AnalysisAI
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually. Rated medium severity (CVSS 6.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-656. There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine. Affected products include: Mobile-Industrial-Robots Mir100 Firmware, Mobile-Industrial-Robots Mir200 Firmware, Mobile-Industrial-Robots Mir250 Firmware, Mobile-Industrial-Robots Mir500 Firmware, Mobile-Industrial-Robots Mir1000 Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Mir100 Firmware
View allMiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational gra
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational gra
Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to a
MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop us
The password for the safety PLC is the default and thus easy to find (in manuals, etc.). Rated critical severity (CVSS 9
The access tokens for the REST API are directly derived from the publicly available default credentials for the web inte
One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles com
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, eff
MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual proper
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default
The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings suc
Same weakness CWE-656 – Reliance on Security Through Obscurity
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today