1. Home
  2. CVE Database
  3. CVE-2020-10275
CRITICAL · 9.8

CVE-2020-10275

The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly w...

Vulnerability Description

The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Mobile-Industrial-RobotsMir100 Firmware<= 2.8.1.1
Mobile-Industrial-RobotsMir100-
Mobile-Industrial-RobotsMir200 Firmware-
Mobile-Industrial-RobotsMir200-
Mobile-Industrial-RobotsMir250 Firmware-
Mobile-Industrial-RobotsMir250-
Mobile-Industrial-RobotsMir500 Firmware-
Mobile-Industrial-RobotsMir500-
Mobile-Industrial-RobotsMir1000 Firmware-
Mobile-Industrial-RobotsMir1000-
EasyroboticsEr200 Firmware-
EasyroboticsEr200-
EasyroboticsEr-Lite Firmware-
EasyroboticsEr-Lite-
EasyroboticsEr-Flex Firmware-
EasyroboticsEr-Flex-
EasyroboticsEr-One Firmware-
EasyroboticsEr-One-
Uvd-RobotsUvd Firmware-
Uvd-RobotsUvd-

Related Weaknesses (CWE)

CWE-326CWE-261

References

FAQ

What is CVE-2020-10275?

CVE-2020-10275 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly w...

How severe is CVE-2020-10275?

CVE-2020-10275 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-10275?

Check the references section above for vendor advisories and patch information. Affected products include: Mobile-Industrial-Robots Mir100 Firmware, Mobile-Industrial-Robots Mir100, Mobile-Industrial-Robots Mir200 Firmware, Mobile-Industrial-Robots Mir200, Mobile-Industrial-Robots Mir250 Firmware.