Mobile Industrial Robots Vehicles and MiR Fleet Software
Successful exploitation of these vulnerabilities could lead to privilege escalation, data exfiltration, control of the robot, and a denial-of-service condition.
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-10280US | high7.5 | — | ||
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard. | ||||
| CVE-2020-10279US | critical9.8OT elevated | — | ||
MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents insecure defaults for rob… | ||||
| CVE-2020-10278US | medium4.6 | — | ||
The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order. This can be leveraged by a Malicious operat… | ||||
| CVE-2020-10277US | medium6.4 | — | ||
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalati… | ||||
| CVE-2020-10276US | critical9.8OT elevated | — | ||
The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling t… | ||||
| CVE-2020-10273US | high7.5OT elevated | — | ||
MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual property artifacts installed in the robots. This flaw allows attac… | ||||
| CVE-2020-10272US | critical9.8OT elevated | — | ||
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers… | ||||
| CVE-2020-10271US | critical9.8 | — | ||
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph to all network interfaces, wireless and wired. This is th… | ||||
| CVE-2017-18255US | high7.8 | — | ||
The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow) or possibl… | ||||
| CVE-2017-7184US | high7.8 | Exploit | ||
The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows loca… | ||||
references
External citations — patches, advisories, analysis.
remediations (20)
- MitigationMiR Fleet in MiR Fleet Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR Fleet in MiR Fleet Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR Fleet in MiR Fleet Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR Fleet in MiR Fleet Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR Fleet in MiR Fleet Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR Fleet in MiR Fleet Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR Fleet in MiR Fleet Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR Fleet in MiR Fleet Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR Fleet in MiR Fleet Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR Fleet in MiR Fleet Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR100 MiR200 MiR250 MiR500 MiR1000 in MiR Robot Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR100 MiR200 MiR250 MiR500 MiR1000 in MiR Robot Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR100 MiR200 MiR250 MiR500 MiR1000 in MiR Robot Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR100 MiR200 MiR250 MiR500 MiR1000 in MiR Robot Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR100 MiR200 MiR250 MiR500 MiR1000 in MiR Robot Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR100 MiR200 MiR250 MiR500 MiR1000 in MiR Robot Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR100 MiR200 MiR250 MiR500 MiR1000 in MiR Robot Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR100 MiR200 MiR250 MiR500 MiR1000 in MiR Robot Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR100 MiR200 MiR250 MiR500 MiR1000 in MiR Robot Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
- MitigationMiR100 MiR200 MiR250 MiR500 MiR1000 in MiR Robot Software
MiR instructs customers to explicitly change default credentials upon configuring the robots, including default SSID and password to the WiFi access point.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan