#VU57191 Improper access control in Mobile Industrial Robots products - CVE-2020-10278

Vulnerability identifier: #VU57191

Vulnerability risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-10278

CWE-ID: CWE-284

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
MiR100
Hardware solutions / Firmware
MiR200
Hardware solutions / Firmware
MiR250
Hardware solutions / Firmware
MiR500
Hardware solutions / Firmware
MiR1000
Hardware solutions / Firmware
MiR Fleet
Hardware solutions / Firmware

Vendor: Mobile Industrial Robots

Description

The vulnerability allows an attacker with physical access to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the lack of a BIOS password is an insecure default configuration, changeable by integrators.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

MiR100: before 2.10.2.1

MiR200: before 2.10.2.1

MiR250: before 2.10.2.1

MiR500: before 2.10.2.1

MiR1000: before 2.10.2.1

MiR Fleet: before 2.10.2.1

---

External links
https://us-cert.cisa.gov/ics/advisories/icsa-21-280-02
https://github.com/aliasrobotics/RVD/issues/2561

---

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.