Vulnerability · Published Jun 24, 2020 · Assigned by Alias

CVE-2020-10269RVD#2566: Hardcoded Credentials on MiRX00 wireless Access Point

Critical 9.8

In plain English

A critical-severity hard-coded credentials in MiR100 from Mobile Industrial Robots A/S. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.0)9.8Critical

Exploit odds (30 days)1.4%top 27.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in WiFi Master (Access Point) mode. Credentials to such wireless Access Point default to well known and widely spread SSID (MiR_RXXXX) and passwords (omitted). This information is also available in past User Guides and manuals which the vendor distributed. We have confirmed this flaw in MiR100 and MiR200 but it might also apply to MiR250, MiR500 and MiR1000.

Affected products (as reported)

Vendor	Product	Versions
Mobile Industrial Robots A/S	MiR100	v2.8.1.1 and before

Weakness: CWE-798 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/aliasrobotics/RVD/issues/2566 x_refsource_CONFIRM