Vulnerability · Published Jun 24, 2020 · Assigned by Alias
CVE-2020-10278RVD#2561: Unprotected BIOS allows user to boot from live OS image.
Medium 6.1
In plain English
A medium-severity improper access control in MiR100 from Mobile Industrial Robots A/S. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS 3.0)6.1Medium
Exploit odds (30 days)1.0%top 38.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order. This can be leveraged by a Malicious operator to boot from a Live Image.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mobile Industrial Robots A/S | MiR100 | v2.8.1.1 and before |
Weakness: CWE-284 · Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
References
- https://github.com/aliasrobotics/RVD/issues/2561 x_refsource_CONFIRM