2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2020-10275" ,
"sourceIdentifier" : "cve@aliasrobotics.com" ,
"published" : "2020-06-24T05:15:13.193" ,
"lastModified" : "2020-07-02T18:11:08.327" ,
"vulnStatus" : "Analyzed" ,
2024-07-14 02:06:08 +00:00
"cveTags" : [ ] ,
2023-04-24 12:24:31 +02:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data."
} ,
{
"lang" : "es" ,
"value" : "Los tokens de acceso para la API REST son derivados directamente desde las credenciales predeterminadas disponibles p\u00fablicamente para la interfaz web. Dado un NOMBRE DE USUARIO y una CONTRASE\u00d1A, la cadena de token est\u00e1 generada directamente con base64(USERNAME:sha256(PASSWORD)). Un atacante no autorizado dentro de la red puede utilizar las credenciales predeterminadas para calcular el token e interactuar con la API REST para filtrar, infiltrar o eliminar datos"
}
] ,
"metrics" : {
"cvssMetricV31" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 9.8 ,
"baseSeverity" : "CRITICAL"
} ,
"exploitabilityScore" : 3.9 ,
"impactScore" : 5.9
}
] ,
"cvssMetricV30" : [
{
"source" : "cve@aliasrobotics.com" ,
"type" : "Secondary" ,
"cvssData" : {
"version" : "3.0" ,
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 9.8 ,
"baseSeverity" : "CRITICAL"
} ,
"exploitabilityScore" : 3.9 ,
"impactScore" : 5.9
}
] ,
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P" ,
"accessVector" : "NETWORK" ,
"accessComplexity" : "LOW" ,
"authentication" : "NONE" ,
"confidentialityImpact" : "PARTIAL" ,
"integrityImpact" : "PARTIAL" ,
"availabilityImpact" : "PARTIAL" ,
"baseScore" : 7.5
} ,
"baseSeverity" : "HIGH" ,
"exploitabilityScore" : 10.0 ,
"impactScore" : 6.4 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : false
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-326"
}
]
} ,
{
"source" : "cve@aliasrobotics.com" ,
"type" : "Secondary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-261"
}
]
}
] ,
"configurations" : [
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:mobile-industrial-robots:mir100_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2.8.1.1" ,
"matchCriteriaId" : "4C1ED80A-1AE1-4868-AD13-F37079F69B60"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:mobile-industrial-robots:mir100:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "11F1060F-0F43-4920-A05D-593E784B1A0B"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:mobile-industrial-robots:mir200_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0E52858B-51DE-44BC-A4BB-D199F1281D72"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:mobile-industrial-robots:mir200:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "2B0F7F08-D5D5-4DA8-B2B2-5EA2997AEE3D"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:mobile-industrial-robots:mir250_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0F19DD45-1C6E-498C-A961-5EDB4823B12C"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:mobile-industrial-robots:mir250:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "44C6FCBE-E111-419E-8F8D-2F4702D821BA"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:mobile-industrial-robots:mir500_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "8C63DB5B-961D-4FDD-AB12-01DC24AFC0B9"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:mobile-industrial-robots:mir500:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "E2BC5C9E-1AF3-4009-844E-6E64E4D766A8"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:mobile-industrial-robots:mir1000_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "171A2B04-114B-4C5F-9F2C-515A1E37F300"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:mobile-industrial-robots:mir1000:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C86EB588-CD48-456B-90C6-C482636508AE"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:easyrobotics:er200_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "42AB077F-A829-4A9F-8AFF-CBC9222EAE55"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:easyrobotics:er200:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C275F303-4494-4C06-95CC-8969E01F8ADA"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:easyrobotics:er-lite_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "68599AB3-679D-4E86-B8F4-7939A0373EA2"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:easyrobotics:er-lite:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "53543812-4D0D-4191-8B21-803D2F9790B6"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:easyrobotics:er-flex_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "1252DDB6-D090-499B-B505-E17625DB88AC"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:easyrobotics:er-flex:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "9D84C826-05A4-44A6-BD12-77805A993A5D"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:easyrobotics:er-one_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "29230027-8A11-48CA-A4E5-63953EB7CAE3"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:easyrobotics:er-one:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C7FFA6B9-1A77-4C25-8120-6844B8700527"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:uvd-robots:uvd_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0C870ABF-C324-442E-9738-025397CB3C47"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:uvd-robots:uvd:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "87684074-A107-4FE3-A840-C5CB3B8025AC"
}
]
}
]
}
] ,
"references" : [
{
"url" : "https://github.com/aliasrobotics/RVD/issues/2565" ,
"source" : "cve@aliasrobotics.com" ,
"tags" : [
"Third Party Advisory"
]
}
]
}
