Lucene search

AliasCVELIST:CVE-2020-10272

HistoryJun 24, 2020 - 12:00 a.m.

CVE-2020-10272 RVD#2554: MiR ROS computational graph presents no authentication mechanisms

2020-06-2400:00:00

CWE-306

Alias

www.cve.org

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

79.7%

JSON

MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire.

CNA Affected

[
  {
    "product": "MiR100",
    "vendor": "Mobile Industrial Robots A/S",
    "versions": [
      {
        "status": "affected",
        "version": "v2.8.1.1 and before"
      }
    ]
  }
]

References

github.com/aliasrobotics/RVD/issues/2554

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

79.7%

JSON

Related for CVELIST:CVE-2020-10272