CVE-2020-10274

EUVD-2020-2729
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
AliasCNA
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 50%
Affected Products (NVD)
VendorProductVersion
mobile-industrial-robotsmir100_firmware
𝑥
≤ 2.8.1.1
mobile-industrial-robotsmir200_firmware
-
mobile-industrial-robotsmir250_firmware
-
mobile-industrial-robotsmir500_firmware
-
mobile-industrial-robotsmir1000_firmware
-
easyroboticser200_firmware
-
easyroboticser-lite_firmware
-
easyroboticser-flex_firmware
-
easyroboticser-one_firmware
-
uvd-robotsuvd_firmware
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/aliasrobotics/RVD/issues/2556
https://github.com/aliasrobotics/RVD/issues/2556