Skip to content
OpenAdvisories

Archive

24 June 2020

Vulnerabilities first published on this day (UTC), newest first.

← May 2020 2020 / June /24 July 2020 →
  1. 138
  2. 256
  3. 3127
  4. 4100
  5. 533
  6. 65
  7. 78
  8. 834
  9. 9222
  10. 1074
  11. 11123
  12. 1228
  13. 13 
  14. 143
  15. 1590
  16. 1653
  17. 1752
  18. 1884
  19. 19193
  20. 202
  21. 218
  22. 2280
  23. 2327
  24. 2466
  25. 2574
  26. 26104
  27. 272
  28. 283
  29. 2972
  30. 3052
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 10.0
    CVE-2020-10279

    RVD#2569: Insecure operating system defaults in MiR robots

    MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents insecure defaults for robots. These insecurities include a way for users to escalate their access beyond…

    Mobile Industrial Robots A/S MiR100
  • Critical 9.8
    CVE-2020-10269

    RVD#2566: Hardcoded Credentials on MiRX00 wireless Access Point

    One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in WiFi Master (Access Point) mode. Credentials to such wireless Access Point default to well known and widely spread SSI…

    Mobile Industrial Robots A/S MiR100
  • Critical 9.8
    CVE-2020-10275

    RVD#2565: Weak token generation for the REST API.

    The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized atta…

    Mobile Industrial Robots A/S MiR100
  • Critical 9.8
    CVE-2020-10270

    RVD#2557: Hardcoded Credentials on MiRX00 Control Dashboard

    Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcoded IP address. Credentials to such wireless interface default to well known and widely spread users…

    Mobile Industrial Robots A/S MiR100
  • Critical 9.8
    CVE-2020-10276

    RVD#2558: Default credentials on SICK PLC allows disabling safety features

    The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and a…

    Mobile Industrial Robots A/S MiR100
  • Critical 10.0
    CVE-2020-10271

    RVD#2555: MiR ROS computational graph is exposed to all network interfaces, including poorly secured wireless networks and open wired ones

    MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph to all network interfaces, wireless and wired. This is the result of a bad set up and can be mitigated by appropriately configuring ROS …

    Mobile Industrial Robots A/S MiR100
  • Critical 10.0
    CVE-2020-10272

    RVD#2554: MiR ROS computational graph presents no authentication mechanisms

    MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the…

    Mobile Industrial Robots A/S MiR100