Vulnerability identifier: #VU57186

Vulnerability risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10271

CWE-ID: N/A

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
MiR100
Hardware solutions / Firmware
MiR200
Hardware solutions / Firmware
MiR250
Hardware solutions / Firmware
MiR500
Hardware solutions / Firmware
MiR1000
Hardware solutions / Firmware
MiR Fleet
Hardware solutions / Firmware

Vendor: Mobile Industrial Robots

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to two APIs to the Robot Operating System (ROS) used in MiR robots are accessible from both wired and wireless network interfaces. A remote attacker can control of the robot, cause a denial of service (DoS) condition and exfiltrate data over the web interface. 

Mitigation
Install updates from vendor's website.

Vulnerable software versions

MiR100: All versions

MiR200: All versions

MiR250: All versions

MiR500: All versions

MiR1000: All versions

MiR Fleet: All versions

---

External links
http://github.com/aliasrobotics/RVD/issues/2555
http://us-cert.cisa.gov/ics/advisories/icsa-21-280-02

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.