Advisories · Technology

Mobile Industrial Robots A/S MiR100.

Every CVE that names Mobile Industrial Robots A/S MiR100 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2020-10279 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

RVD#2569: Insecure operating system defaults in MiR robots
- Mobile Industrial Robots A/S MiR100
- Broken access control
Not analysed yet 24 Jun 2020
CVE-2020-10280 CVE record

CVSS 8.2 High

RVD#2568: Apache server is vulnerable to a DoS
- Mobile Industrial Robots A/S MiR100
- CWE-239
Not analysed yet 24 Jun 2020
CVE-2020-10269 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

RVD#2566: Hardcoded Credentials on MiRX00 wireless Access Point
- Mobile Industrial Robots A/S MiR100
- Hard-coded credentials
Not analysed yet 24 Jun 2020
CVE-2020-10275 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

RVD#2565: Weak token generation for the REST API.
- Mobile Industrial Robots A/S MiR100
- CWE-261
Not analysed yet 24 Jun 2020
CVE-2020-10273 CVE record

CVSS 7.5 High

RVD#2560: Unprotected intellectual property in Mobile Industrial Robots (MiR) controllers
- Mobile Industrial Robots A/S MiR100
- Weak cryptography or TLS
Not analysed yet 24 Jun 2020
CVE-2020-10278 CVE record

CVSS 6.1 Medium

RVD#2561: Unprotected BIOS allows user to boot from live OS image.
- Mobile Industrial Robots A/S MiR100
- Broken access control
Not analysed yet 24 Jun 2020
CVE-2020-10277 CVE record

CVSS 6.4 Medium

RVD#2562: Booting from a live image leads to exfiltration of sensible information and privilege escalation
- Mobile Industrial Robots A/S MiR100
- CWE-656
Not analysed yet 24 Jun 2020
CVE-2020-10270 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

RVD#2557: Hardcoded Credentials on MiRX00 Control Dashboard
- Mobile Industrial Robots A/S MiR100
- Hard-coded credentials
Not analysed yet 24 Jun 2020
CVE-2020-10276 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

RVD#2558: Default credentials on SICK PLC allows disabling safety features
- Mobile Industrial Robots A/S MiR100
- Hard-coded credentials
Not analysed yet 24 Jun 2020
CVE-2020-10271 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

RVD#2555: MiR ROS computational graph is exposed to all network interfaces, including poorly secured wireless networks and open wired ones
- Mobile Industrial Robots A/S MiR100
- Information disclosure
Not analysed yet 24 Jun 2020
CVE-2020-10274 CVE record

CVSS 7.1 High

RVD#2556: MiR REST API allows for data exfiltration by unauthorized attackers (e.g. indoor maps)
- Mobile Industrial Robots A/S MiR100
- Information disclosure
Not analysed yet 24 Jun 2020
CVE-2020-10272 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

RVD#2554: MiR ROS computational graph presents no authentication mechanisms
- Mobile Industrial Robots A/S MiR100
- Authentication bypass
Not analysed yet 24 Jun 2020