ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2020-10274

—
CVSS 3.1
7.1 high
EPSS
<1%p58
Published
()
Modified
Description

The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.

Vendors
mobile-industrial-robotseasyroboticsuvd-robots
Products
mir100 firmware, mir200 firmware, mir250 firmware, mir500 firmware, mir1000 firmware, er200 firmware, er-lite firmware, er-flex firmware, er-one firmware, uvd firmware
Weakness
CWE-200, CWE-330
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news

No ingested article mentions this CVE yet.