cve@aliasrobotics.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS cve@aliasrobotics.com
03
assessed vulnerabilities (28)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-10292US | high8.2 | — | ||
Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components so… | ||||
| CVE-2020-10291US | high7.5OT elevated | — | ||
Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components so… | ||||
| CVE-2020-10290US | medium6.8 | — | ||
Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents many primitives that ca… | ||||
| CVE-2020-10283US | critical9.8OT elevated | — | ||
The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation, in order to maintain backwards compatibi… | ||||
| CVE-2020-10289US | high8.8 | — | ||
Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is proces… | ||||
| CVE-2020-10288US | critical9.8 | — | ||
IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you can input whatever you like. As long as… | ||||
| CVE-2020-10287US | critical9.8 | — | ||
The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documented functionality that… | ||||
| CVE-2020-10286US | high8.8 | — | ||
the main user account has restricted privileges but is in the sudoers group and there is not any mechanism in place to prevent sudo su or sudo -i to be run gaining unrestricted acc… | ||||
| CVE-2020-10285US | critical9.8 | — | ||
The authentication implementation on the xArm controller has very low entropy, making it vulnerable to a brute-force attack. There is no mechanism in place to mitigate or lockout a… | ||||
| CVE-2020-10284US | critical9.1 | — | ||
No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets the user to add a password to the robot but… | ||||
| CVE-2020-10282US | critical9.8OT elevated | — | ||
The Micro Air Vehicle Link (MAVLink) protocol presents no authentication mechanism on its version 1.0 (nor authorization) whichs leads to a variety of attacks including identity sp… | ||||
| CVE-2020-10281US | high7.5OT elevated | — | ||
This vulnerability applies to the Micro Air Vehicle Link (MAVLink) protocol and allows a remote attacker to gain access to sensitive information provided it has access to the commu… | ||||
| CVE-2020-10280US | high7.5 | — | ||
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard. | ||||
| CVE-2020-10279US | critical9.8OT elevated | — | ||
MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents insecure defaults for rob… | ||||
| CVE-2020-10278US | medium4.6 | — | ||
The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order. This can be leveraged by a Malicious operat… | ||||
| CVE-2020-10277US | medium6.4 | — | ||
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalati… | ||||
| CVE-2020-10276US | critical9.8OT elevated | — | ||
The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling t… | ||||
| CVE-2020-10275US | critical9.8 | — | ||
The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is… | ||||
| CVE-2020-10274US | high7.1OT elevated | — | ||
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-1… | ||||
| CVE-2020-10273US | high7.5OT elevated | — | ||
MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual property artifacts installed in the robots. This flaw allows attac… | ||||