Login Request a demo
High severity · published Jun 24, 2020
CVE-2020-10274
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to…
7.1
CVSS
0.9%
EPSS
No
On KEV
Description
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
Er-flex Firmware · Easyrobotics
All versions, or not specified · source: NVD
EF
Er-lite Firmware · Easyrobotics
All versions, or not specified · source: NVD
EF
Er-one Firmware · Easyrobotics
All versions, or not specified · source: NVD
EF
Er200 Firmware · Easyrobotics
All versions, or not specified · source: NVD
MF
Mir100 Firmware · Mobile-industrial-robots
through 2.8.1.1 · source: NVD
MF
Mir1000 Firmware · Mobile-industrial-robots
All versions, or not specified · source: NVD
MF
Mir200 Firmware · Mobile-industrial-robots
All versions, or not specified · source: NVD
MF
Mir250 Firmware · Mobile-industrial-robots
All versions, or not specified · source: NVD
MF
Mir500 Firmware · Mobile-industrial-robots
All versions, or not specified · source: NVD
UF
Uvd Firmware · Uvd-robots
All versions, or not specified · source: NVD
Affected product
EF
Er-flex Firmware
Easyrobotics
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10274
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10274
Third Party Advisory
https://github.com/aliasrobotics/RVD/issues/2556
More from Er-flex Firmware
9.8
CVE-2020-10276
The password for the safety PLC is the default and thus easy to find (in manuals, etc.)
9.8
CVE-2020-10275
The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface
7.5
CVE-2020-10280
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard
6.4
CVE-2020-10277
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege…