CVE-2020-10276

Published: Jun 24, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the laser scanner are not affected (thus it is hard to detect before something happens) though the laser scanner configuration can also be affected altering further the safety of the device.

Affected (10)

Products: Mobile Industrial Robots: Mir100 Firmware, Mir200 Firmware, Mir250 Firmware, Mir500 Firmware, Mir1000 Firmware · Easyrobotics: Er200 Firmware, Er Lite Firmware, Er Flex Firmware, Er One Firmware · Uvd Robots: Uvd Firmware

Mobile Industrial Robots

5 products

4 products

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir100 Firmware	Up to 2.8.1.1

Running on/with	Platform Versions
Mobile Industrial Robots Mir100	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir200 Firmware	All versions

Running on/with	Platform Versions
Mobile Industrial Robots Mir200	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir250 Firmware	All versions

Running on/with	Platform Versions
Mobile Industrial Robots Mir250	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir500 Firmware	All versions

Running on/with	Platform Versions
Mobile Industrial Robots Mir500	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mobile Industrial Robots Mir1000 Firmware	All versions

Running on/with	Platform Versions
Mobile Industrial Robots Mir1000	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Easyrobotics Er200 Firmware	All versions

Running on/with	Platform Versions
Easyrobotics Er200	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Easyrobotics Er Lite Firmware	All versions

Running on/with	Platform Versions
Easyrobotics Er Lite	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Easyrobotics Er Flex Firmware	All versions

Running on/with	Platform Versions
Easyrobotics Er Flex	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Easyrobotics Er One Firmware	All versions

Running on/with	Platform Versions
Easyrobotics Er One	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Uvd Robots Uvd Firmware	All versions

Running on/with	Platform Versions
Uvd Robots Uvd	All versions

Related CWEs

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (2)

https://github.com/aliasrobotics/RVD/issues/2558

Source: cve@aliasrobotics.com

Third Party Advisory

https://github.com/aliasrobotics/RVD/issues/2558

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.