VAR-202006-0268
Vulnerability from variot - Updated: 2025-01-30 21:44MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire. plural MiR The product contains vulnerabilities related to lack of authentication for critical features.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202006-0268",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mir250",
"scope": "lte",
"trust": 1.0,
"vendor": "aliasrobotics",
"version": "2.8.1.1"
},
{
"model": "er-flex",
"scope": "lte",
"trust": 1.0,
"vendor": "enabled robotics",
"version": "2.8.1.1"
},
{
"model": "mir500",
"scope": "lte",
"trust": 1.0,
"vendor": "aliasrobotics",
"version": "2.8.1.1"
},
{
"model": "mir100",
"scope": "lte",
"trust": 1.0,
"vendor": "aliasrobotics",
"version": "2.8.1.1"
},
{
"model": "er-lite",
"scope": "lte",
"trust": 1.0,
"vendor": "enabled robotics",
"version": "2.8.1.1"
},
{
"model": "mir200",
"scope": "lte",
"trust": 1.0,
"vendor": "aliasrobotics",
"version": "2.8.1.1"
},
{
"model": "mir1000",
"scope": "lte",
"trust": 1.0,
"vendor": "aliasrobotics",
"version": "2.8.1.1"
},
{
"model": "er-one",
"scope": "lte",
"trust": 1.0,
"vendor": "enabled robotics",
"version": "2.8.1.1"
},
{
"model": "er200",
"scope": "lte",
"trust": 1.0,
"vendor": "mobile industrial robotics",
"version": "2.8.1.1"
},
{
"model": "uvd robots",
"scope": "lte",
"trust": 1.0,
"vendor": "uvd robots",
"version": "2.8.1.1"
},
{
"model": "er-flex",
"scope": null,
"trust": 0.8,
"vendor": "easyrobotics",
"version": null
},
{
"model": "er-lite",
"scope": null,
"trust": 0.8,
"vendor": "easyrobotics",
"version": null
},
{
"model": "er-one",
"scope": null,
"trust": 0.8,
"vendor": "easyrobotics",
"version": null
},
{
"model": "er200",
"scope": null,
"trust": 0.8,
"vendor": "easyrobotics",
"version": null
},
{
"model": "mir100",
"scope": null,
"trust": 0.8,
"vendor": "mobile industrial robots a s",
"version": null
},
{
"model": "mir1000",
"scope": null,
"trust": 0.8,
"vendor": "mobile industrial robots a s",
"version": null
},
{
"model": "mir200",
"scope": null,
"trust": 0.8,
"vendor": "mobile industrial robots a s",
"version": null
},
{
"model": "mir250",
"scope": null,
"trust": 0.8,
"vendor": "mobile industrial robots a s",
"version": null
},
{
"model": "mir500",
"scope": null,
"trust": 0.8,
"vendor": "mobile industrial robots a s",
"version": null
},
{
"model": "uvd",
"scope": null,
"trust": 0.8,
"vendor": "uvd robots",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-007374"
},
{
"db": "NVD",
"id": "CVE-2020-10272"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:easyrobotics:er-flex_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:easyrobotics:er-lite_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:easyrobotics:er-one_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:easyrobotics:er200_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:mobile-industrial-robots:mir100_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:mobile-industrial-robots:mir1000_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:mobile-industrial-robots:mir200_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:mobile-industrial-robots:mir250_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:mobile-industrial-robots:mir500_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:uvd-robots:uvd_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-007374"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Victor Mayoral Vilches of Alias Robotics reported these vulnerabilities to CISA.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202006-1663"
}
],
"trust": 0.6
},
"cve": "CVE-2020-10272",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2020-10272",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.0,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2020-007374",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2020-10272",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "cve@aliasrobotics.com",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2020-10272",
"impactScore": 6.0,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-007374",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2020-10272",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "cve@aliasrobotics.com",
"id": "CVE-2020-10272",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "JVNDB-2020-007374",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-202006-1663",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-007374"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1663"
},
{
"db": "NVD",
"id": "CVE-2020-10272"
},
{
"db": "NVD",
"id": "CVE-2020-10272"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire. plural MiR The product contains vulnerabilities related to lack of authentication for critical features.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-10272"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-007374"
}
],
"trust": 1.62
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-10272",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2020-007374",
"trust": 0.8
},
{
"db": "AUSCERT",
"id": "ESB-2021.3344",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021101107",
"trust": 0.6
},
{
"db": "ICS CERT",
"id": "ICSA-21-280-02",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1663",
"trust": 0.6
},
{
"db": "OTHER",
"id": "NONE",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "JVNDB",
"id": "JVNDB-2020-007374"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1663"
},
{
"db": "NVD",
"id": "CVE-2020-10272"
}
]
},
"id": "VAR-202006-0268",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "OTHER",
"id": null
}
],
"trust": 0.01
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"industrial device"
],
"sub_category": "robot",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
}
]
},
"last_update_date": "2025-01-30T21:44:48.070000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.easyrobotics.biz/"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.mobile-industrial-robots.com/en/"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.uvd-robots.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-007374"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-306",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-007374"
},
{
"db": "NVD",
"id": "CVE-2020-10272"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://github.com/aliasrobotics/rvd/issues/2554"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-10272"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-10272"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021101107"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-280-02"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.3344"
},
{
"trust": 0.1,
"url": "https://ieeexplore.ieee.org/abstract/document/10769424"
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "JVNDB",
"id": "JVNDB-2020-007374"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1663"
},
{
"db": "NVD",
"id": "CVE-2020-10272"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "OTHER",
"id": null
},
{
"db": "JVNDB",
"id": "JVNDB-2020-007374"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1663"
},
{
"db": "NVD",
"id": "CVE-2020-10272"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-08-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-007374"
},
{
"date": "2020-06-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202006-1663"
},
{
"date": "2020-06-24T05:15:12.943000",
"db": "NVD",
"id": "CVE-2020-10272"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-08-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-007374"
},
{
"date": "2022-03-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202006-1663"
},
{
"date": "2024-11-21T04:55:06.683000",
"db": "NVD",
"id": "CVE-2020-10272"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202006-1663"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural MiR Vulnerability regarding lack of authentication for critical features in the product",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-007374"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "access control error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202006-1663"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…