CVE-2020-10274

Published: Jun 24, 2020Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Exploitability: 2.8 / Impact: 4.2

Source: NVD

Description

The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.

Affected (10)

Products: Mobile Industrial Robots: Mir100 Firmware, Mir200 Firmware, Mir250 Firmware, Mir500 Firmware, Mir1000 Firmware · Easyrobotics: Er200 Firmware, Er Lite Firmware, Er Flex Firmware, Er One Firmware · Uvd Robots: Uvd Firmware

Mobile Industrial Robots

5 products

4 products

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir100 Firmware	Up to 2.8.1.1

Running on/with	Platform Versions
Mobile Industrial Robots Mir100	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir200 Firmware	All versions

Running on/with	Platform Versions
Mobile Industrial Robots Mir200	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir250 Firmware	All versions

Running on/with	Platform Versions
Mobile Industrial Robots Mir250	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir500 Firmware	All versions

Running on/with	Platform Versions
Mobile Industrial Robots Mir500	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir1000 Firmware	All versions

Running on/with	Platform Versions
Mobile Industrial Robots Mir1000	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Easyrobotics Er200 Firmware	All versions

Running on/with	Platform Versions
Easyrobotics Er200	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Easyrobotics Er Lite Firmware	All versions

Running on/with	Platform Versions
Easyrobotics Er Lite	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Easyrobotics Er Flex Firmware	All versions

Running on/with	Platform Versions
Easyrobotics Er Flex	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Easyrobotics Er One Firmware	All versions

Running on/with	Platform Versions
Easyrobotics Er One	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Uvd Robots Uvd Firmware	All versions

Running on/with	Platform Versions
Uvd Robots Uvd	All versions

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-330

Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

References (2)

https://github.com/aliasrobotics/RVD/issues/2556

Source: cve@aliasrobotics.com

Third Party Advisory

https://github.com/aliasrobotics/RVD/issues/2556

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.