Vulnerability identifier: #VU57191

Vulnerability risk: Low

CVSSv3.1: 4 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10278

CWE-ID: CWE-284

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
MiR100
Hardware solutions / Firmware
MiR200
Hardware solutions / Firmware
MiR250
Hardware solutions / Firmware
MiR500
Hardware solutions / Firmware
MiR1000
Hardware solutions / Firmware
MiR Fleet
Hardware solutions / Firmware

Vendor: Mobile Industrial Robots

Description

The vulnerability allows an attacker with physical access to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the lack of a BIOS password is an insecure default configuration, changeable by integrators.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

MiR100: All versions

MiR200: All versions

MiR250: All versions

MiR500: All versions

MiR1000: All versions

MiR Fleet: All versions

---

External links
http://us-cert.cisa.gov/ics/advisories/icsa-21-280-02
http://github.com/aliasrobotics/RVD/issues/2561

---

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.