CVE-2020-10275

Published: Jun 24, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.

Affected (10)

Products: Mobile Industrial Robots: Mir100 Firmware, Mir200 Firmware, Mir250 Firmware, Mir500 Firmware, Mir1000 Firmware · Easyrobotics: Er200 Firmware, Er Lite Firmware, Er Flex Firmware, Er One Firmware · Uvd Robots: Uvd Firmware

Mobile Industrial Robots

5 products

4 products

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir100 Firmware	Up to 2.8.1.1

Running on/with	Platform Versions
Mobile Industrial Robots Mir100	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir200 Firmware	All versions

Running on/with	Platform Versions
Mobile Industrial Robots Mir200	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir250 Firmware	All versions

Running on/with	Platform Versions
Mobile Industrial Robots Mir250	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir500 Firmware	All versions

Running on/with	Platform Versions
Mobile Industrial Robots Mir500	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir1000 Firmware	All versions

Running on/with	Platform Versions
Mobile Industrial Robots Mir1000	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Easyrobotics Er200 Firmware	All versions

Running on/with	Platform Versions
Easyrobotics Er200	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Easyrobotics Er Lite Firmware	All versions

Running on/with	Platform Versions
Easyrobotics Er Lite	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Easyrobotics Er Flex Firmware	All versions

Running on/with	Platform Versions
Easyrobotics Er Flex	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Easyrobotics Er One Firmware	All versions

Running on/with	Platform Versions
Easyrobotics Er One	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Uvd Robots Uvd Firmware	All versions

Running on/with	Platform Versions
Uvd Robots Uvd	All versions

Related CWEs

CWE-261

Weak Encoding for Password

Obscuring a password with a trivial encoding does not protect the password.

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (2)

https://github.com/aliasrobotics/RVD/issues/2565

Source: cve@aliasrobotics.com

Third Party Advisory

https://github.com/aliasrobotics/RVD/issues/2565

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.