Missing Authentication for Critical Function in Mobile Industrial Robots products - CVE-2020-10272

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to Robot Operating System (ROS) default packages are used, which expose the computational graph without any authentication. A remote attacker on the local network can take control of the robot.

Affected software

How to mitigate CVE-2020-10272

External References

• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-02
• https://github.com/aliasrobotics/RVD/issues/2554

Related Security Bulletins

• Multiple vulnerabilities in Mobile Industrial Robots Vehicles and MiR Fleet Software