Vulnerability identifier: #VU57192

Vulnerability risk: Low

CVSSv3.1: 7.3 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10279

CWE-ID: CWE-276

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
MiR100
Hardware solutions / Firmware
MiR200
Hardware solutions / Firmware
MiR250
Hardware solutions / Firmware
MiR500
Hardware solutions / Firmware
MiR1000
Hardware solutions / Firmware
MiR Fleet
Hardware solutions / Firmware

Vendor: Mobile Industrial Robots

Description

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions. A local attacker with access to the robot operating system (ROS) can perform privilege escalation or cause denial-of-service.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

MiR100: All versions

MiR200: All versions

MiR250: All versions

MiR500: All versions

MiR1000: All versions

MiR Fleet: All versions

---

External links
http://us-cert.cisa.gov/ics/advisories/icsa-21-280-02
http://github.com/aliasrobotics/RVD/issues/2569

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.