Vulnerability · Published Jun 24, 2020 · Assigned by Alias

CVE-2020-10272RVD#2554: MiR ROS computational graph presents no authentication mechanisms

Critical 10.0

In plain English

A critical-severity missing authentication in MiR100 from Mobile Industrial Robots A/S. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).

Severity (CVSS 3.0)10.0Critical

Exploit odds (30 days)2.5%top 15.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire.

Affected products (as reported)

Vendor	Product	Versions
Mobile Industrial Robots A/S	MiR100	v2.8.1.1 and before

Weakness: CWE-306 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/aliasrobotics/RVD/issues/2554 x_refsource_CONFIRM