CVE-2020-10269

moderate-risk

Published 2020-06-24

One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in WiFi Master (Access Point) mode. Credentials to such wireless Access Point default to well known and widely spread SSID (MiR_RXXXX) and passwords (omitted). This information is also available in past User Guides and manuals which the vendor distributed. We have confirmed this flaw in MiR100 and MiR200 but it might also apply to MiR250, MiR500 and MiR1000.

Do I need to act?

0.30% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (10)

Mir100 Firmware

Mir200 Firmware

Mir250 Firmware

Mir500 Firmware

Mir1000 Firmware

Er200 Firmware

Er-Lite Firmware

Er-Flex Firmware

Er-One Firmware

Uvd Robots Firmware

Affected Vendors

Aliasrobotics Mobile-Industrial-Robotics Enabled-Robotics Uvd-Robots

References (2)

Third Party Advisory https://github.com/aliasrobotics/RVD/issues/2566

/ 100

moderate-risk

Severity 32/34 · Critical

Exploitability 1/34 · Minimal

Exposure 16/34 · Moderate