CVE-2020-10274

CVSS 7.1v3.1pub. 2020-06-24upd. 2024-11-21

The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Easyrobotics Er200
HW
Easyrobotics
all versions
Easyrobotics Er200 Firmware
OS
Easyrobotics
all versions
Easyrobotics Er Flex
HW
Easyrobotics
all versions
Easyrobotics Er Flex Firmware
OS
Easyrobotics
all versions
Easyrobotics Er Lite
HW
Easyrobotics
all versions
Easyrobotics Er Lite Firmware
OS
Easyrobotics
all versions
Easyrobotics Er One
HW
Easyrobotics
all versions
Easyrobotics Er One Firmware
OS
Easyrobotics
all versions
Mobile Industrial Robots Mir100
HW
Mobile-Industrial-Robots
all versions
Mobile Industrial Robots Mir1000
HW
Mobile-Industrial-Robots
all versions
Mobile Industrial Robots Mir1000 Firmware
OS
Mobile-Industrial-Robots
all versions
Mobile Industrial Robots Mir100 Firmware
OS
Mobile-Industrial-Robots
≤ 2.8.1.1
Mobile Industrial Robots Mir200
HW
Mobile-Industrial-Robots
all versions
Mobile Industrial Robots Mir200 Firmware
OS
Mobile-Industrial-Robots
all versions
Mobile Industrial Robots Mir250
HW
Mobile-Industrial-Robots
all versions
Mobile Industrial Robots Mir250 Firmware
OS
Mobile-Industrial-Robots
all versions
Mobile Industrial Robots Mir500
HW
Mobile-Industrial-Robots
all versions
Mobile Industrial Robots Mir500 Firmware
OS
Mobile-Industrial-Robots
all versions
Uvd Robots Uvd
HW
Uvd-Robots
all versions
Uvd Robots Uvd Firmware
OS
Uvd-Robots
all versions