Improper access control in Mobile Industrial Robots products - CVE-2020-10276

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to MiR robots shipped before June 2020 had default passwords set for the SICK safety PLC. A remote attacker on the local network can use the default credentials to manipulate the safety PLC, effectively disabling the emergency stop function. 

Affected software

How to mitigate CVE-2020-10276

External References

• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-02
• https://github.com/aliasrobotics/RVD/issues/2558

Related Security Bulletins

• Multiple vulnerabilities in Mobile Industrial Robots Vehicles and MiR Fleet Software