複数の MiR 製品における重要な機能に対する認証の欠如に関する脆弱性
| Title |
複数の MiR 製品における重要な機能に対する認証の欠如に関する脆弱性
|
| Summary |
複数の MiR 製品には、重要な機能に対する認証の欠如に関する脆弱性が存在します。
|
| Possible impacts |
情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution |
ベンダ情報および参考情報を参照して適切な対策を実施してください。 |
| Publication Date |
June 24, 2020, midnight |
| Registration Date |
Aug. 11, 2020, 4 p.m. |
| Last Update |
Oct. 15, 2021, 4:21 p.m. |
|
CVSS3.0 : 緊急
|
| Score |
9.8
|
| Vector |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
|
CVSS2.0 : 危険
|
| Score |
10
|
| Vector |
AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected System
| UVD Robots |
|
UVD ファームウェア
|
| Mobile Industrial Robots A/S |
|
MiR100 ファームウェア
|
|
MiR1000 ファームウェア
|
|
MiR200 ファームウェア
|
|
MiR250 ファームウェア
|
|
MiR500 ファームウェア
|
| EasyRobotics |
|
ER-Flex ファームウェア
|
|
ER-Lite ファームウェア
|
|
ER-One ファームウェア
|
|
ER200 ファームウェア
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
その他
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2020年08月11日]
掲載 |
Aug. 11, 2020, 4 p.m. |
| 2 |
[2021年10月15日]
参考情報：JVN (JVNVU#93417317) を追加
参考情報：ICS-CERT ADVISORY (ICSA-21-280-02) を追加 |
Oct. 15, 2021, 2:31 p.m. |
NVD Vulnerability Information
CVE-2020-10272
| Summary |
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire.
|
| Publication Date |
June 24, 2020, 2:15 p.m. |
| Registration Date |
Jan. 26, 2021, 11:50 a.m. |
| Last Update |
Nov. 21, 2024, 1:55 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:o:aliasrobotics:mir100_firmware:*:*:*:*:*:*:*:* |
|
2.8.1.1 |
|
|
| execution environment |
| 1 |
cpe:2.3:h:aliasrobotics:mir100:-:*:*:*:*:*:*:* |
| Configuration2 |
or higher |
or less |
more than |
less than |
| cpe:2.3:o:aliasrobotics:mir200_firmware:*:*:*:*:*:*:*:* |
|
2.8.1.1 |
|
|
| execution environment |
| 1 |
cpe:2.3:h:aliasrobotics:mir200:-:*:*:*:*:*:*:* |
| Configuration3 |
or higher |
or less |
more than |
less than |
| cpe:2.3:o:aliasrobotics:mir250_firmware:*:*:*:*:*:*:*:* |
|
2.8.1.1 |
|
|
| execution environment |
| 1 |
cpe:2.3:h:aliasrobotics:mir250:-:*:*:*:*:*:*:* |
| Configuration4 |
or higher |
or less |
more than |
less than |
| cpe:2.3:o:aliasrobotics:mir500_firmware:*:*:*:*:*:*:*:* |
|
2.8.1.1 |
|
|
| execution environment |
| 1 |
cpe:2.3:h:aliasrobotics:mir500:-:*:*:*:*:*:*:* |
| Configuration5 |
or higher |
or less |
more than |
less than |
| cpe:2.3:o:aliasrobotics:mir1000_firmware:*:*:*:*:*:*:*:* |
|
2.8.1.1 |
|
|
| execution environment |
| 1 |
cpe:2.3:h:aliasrobotics:mir1000:-:*:*:*:*:*:*:* |
| Configuration6 |
or higher |
or less |
more than |
less than |
| cpe:2.3:o:mobile-industrial-robotics:er200_firmware:*:*:*:*:*:*:*:* |
|
2.8.1.1 |
|
|
| execution environment |
| 1 |
cpe:2.3:h:mobile-industrial-robotics:er200:-:*:*:*:*:*:*:* |
| Configuration7 |
or higher |
or less |
more than |
less than |
| cpe:2.3:o:enabled-robotics:er-lite_firmware:*:*:*:*:*:*:*:* |
|
2.8.1.1 |
|
|
| execution environment |
| 1 |
cpe:2.3:h:enabled-robotics:er-lite:-:*:*:*:*:*:*:* |
| Configuration8 |
or higher |
or less |
more than |
less than |
| cpe:2.3:o:enabled-robotics:er-flex_firmware:*:*:*:*:*:*:*:* |
|
2.8.1.1 |
|
|
| execution environment |
| 1 |
cpe:2.3:h:enabled-robotics:er-flex:-:*:*:*:*:*:*:* |
| Configuration9 |
or higher |
or less |
more than |
less than |
| cpe:2.3:o:enabled-robotics:er-one_firmware:*:*:*:*:*:*:*:* |
|
2.8.1.1 |
|
|
| execution environment |
| 1 |
cpe:2.3:h:enabled-robotics:er-one:-:*:*:*:*:*:*:* |
| Configuration10 |
or higher |
or less |
more than |
less than |
| cpe:2.3:o:uvd-robots:uvd_robots_firmware:*:*:*:*:*:*:*:* |
|
2.8.1.1 |
|
|
| execution environment |
| 1 |
cpe:2.3:h:uvd-robots:uvd_robots:-:*:*:*:*:*:*:* |
Related information, measures and tools
Common Vulnerabilities List