CVE-2020-10272

Published: Jun 24, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire.

Affected (10)

Products: Aliasrobotics: Mir100 Firmware, Mir200 Firmware, Mir250 Firmware, Mir500 Firmware, Mir1000 Firmware · Mobile Industrial Robotics: Er200 Firmware · Enabled Robotics: Er Lite Firmware, Er Flex Firmware, Er One Firmware · +1 more

Show all products

Aliasrobotics: Mir100 Firmware, Mir200 Firmware, Mir250 Firmware, Mir500 Firmware, Mir1000 Firmware · Mobile Industrial Robotics: Er200 Firmware · Enabled Robotics: Er Lite Firmware, Er Flex Firmware, Er One Firmware · Uvd Robots: Uvd Robots Firmware

5 products

Mobile Industrial Robotics

1 product

3 products

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Aliasrobotics Mir100 Firmware	Up to 2.8.1.1

Running on/with	Platform Versions
Aliasrobotics Mir100	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Aliasrobotics Mir200 Firmware	Up to 2.8.1.1

Running on/with	Platform Versions
Aliasrobotics Mir200	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Aliasrobotics Mir250 Firmware	Up to 2.8.1.1

Running on/with	Platform Versions
Aliasrobotics Mir250	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Aliasrobotics Mir500 Firmware	Up to 2.8.1.1

Running on/with	Platform Versions
Aliasrobotics Mir500	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Aliasrobotics Mir1000 Firmware	Up to 2.8.1.1

Running on/with	Platform Versions
Aliasrobotics Mir1000	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robotics Er200 Firmware	Up to 2.8.1.1

Running on/with	Platform Versions
Mobile Industrial Robotics Er200	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Enabled Robotics Er Lite Firmware	Up to 2.8.1.1

Running on/with	Platform Versions
Enabled Robotics Er Lite	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Enabled Robotics Er Flex Firmware	Up to 2.8.1.1

Running on/with	Platform Versions
Enabled Robotics Er Flex	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Enabled Robotics Er One Firmware	Up to 2.8.1.1

Running on/with	Platform Versions
Enabled Robotics Er One	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Uvd Robots Uvd Robots Firmware	Up to 2.8.1.1

Running on/with	Platform Versions
Uvd Robots Uvd Robots	All versions

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://github.com/aliasrobotics/RVD/issues/2554

Source: cve@aliasrobotics.com

ExploitThird Party Advisory

https://github.com/aliasrobotics/RVD/issues/2554

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.