Details of VAR-202006-0270

ID

VAR-202006-0270

CVE

CVE-2020-10274

TITLE

Information leak vulnerabilities in multiple products

Trust: 0.8

sources: JVNDB: JVNDB-2020-007376

DESCRIPTION

The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database. Information leakage vulnerabilities exist in multiple products.Information may be obtained and tampered with

Trust: 1.62

sources: NVD: CVE-2020-10274 // JVNDB: JVNDB-2020-007376

IOT TAXONOMY

category:

['industrial device']

sub_category:

robot

Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:	uvd robots	model:	uvd	scope:	eq	version:	-	Trust: 1.0
vendor:	easyrobotics	model:	er-flex	scope:	eq	version:	-	Trust: 1.0
vendor:	mobile industrial robots	model:	mir250	scope:	eq	version:	-	Trust: 1.0
vendor:	easyrobotics	model:	er200	scope:	eq	version:	-	Trust: 1.0
vendor:	mobile industrial robots	model:	mir500	scope:	eq	version:	-	Trust: 1.0
vendor:	mobile industrial robots	model:	mir200	scope:	eq	version:	-	Trust: 1.0
vendor:	easyrobotics	model:	er-one	scope:	eq	version:	-	Trust: 1.0
vendor:	mobile industrial robots	model:	mir100	scope:	lte	version:	2.8.1.1	Trust: 1.0
vendor:	mobile industrial robots	model:	mir1000	scope:	eq	version:	-	Trust: 1.0
vendor:	easyrobotics	model:	er-lite	scope:	eq	version:	-	Trust: 1.0
vendor:	easyrobotics	model:	er-flex	scope:	-	version:	-	Trust: 0.8
vendor:	easyrobotics	model:	er-lite	scope:	-	version:	-	Trust: 0.8
vendor:	easyrobotics	model:	er-one	scope:	-	version:	-	Trust: 0.8
vendor:	easyrobotics	model:	er200	scope:	-	version:	-	Trust: 0.8
vendor:	mobile industrial robots a s	model:	mir100	scope:	-	version:	-	Trust: 0.8
vendor:	mobile industrial robots a s	model:	mir1000	scope:	-	version:	-	Trust: 0.8
vendor:	mobile industrial robots a s	model:	mir200	scope:	-	version:	-	Trust: 0.8
vendor:	mobile industrial robots a s	model:	mir250	scope:	-	version:	-	Trust: 0.8
vendor:	mobile industrial robots a s	model:	mir500	scope:	-	version:	-	Trust: 0.8
vendor:	uvd robots	model:	uvd	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2020-007376 // NVD: CVE-2020-10274

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-10274
value:	HIGH
Trust: 1.0
cve@aliasrobotics.com:	CVE-2020-10274
value:	HIGH
Trust: 1.0
NVD:	JVNDB-2020-007376
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202006-1668
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2020-10274
severity:	MEDIUM
baseScore:	5.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2020-007376
severity:	MEDIUM
baseScore:	5.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

nvd@nist.gov:	CVE-2020-10274
baseSeverity:	HIGH
baseScore:	7.1
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	4.2
version:	3.1
Trust: 1.0
cve@aliasrobotics.com:	CVE-2020-10274
baseSeverity:	HIGH
baseScore:	7.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	4.2
version:	3.0
Trust: 1.0
NVD:	JVNDB-2020-007376
baseSeverity:	HIGH
baseScore:	7.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2020-007376 // CNNVD: CNNVD-202006-1668 // NVD: CVE-2020-10274 // NVD: CVE-2020-10274

PROBLEMTYPE DATA

problemtype:	CWE-200	Trust: 1.8
problemtype:	CWE-330	Trust: 1.0

sources: JVNDB: JVNDB-2020-007376 // NVD: CVE-2020-10274

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202006-1668

TYPE

security feature problem

Trust: 0.6

sources: CNNVD: CNNVD-202006-1668

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-007376

PATCH

title:	Top Page	url:	https://www.easyrobotics.biz/	Trust: 0.8
title:	Top Page	url:	https://www.mobile-industrial-robots.com/en/	Trust: 0.8
title:	Top Page	url:	http://www.uvd-robots.com/	Trust: 0.8

sources: JVNDB: JVNDB-2020-007376

EXTERNAL IDS

db:	NVD	id:	CVE-2020-10274	Trust: 2.5
db:	JVNDB	id:	JVNDB-2020-007376	Trust: 0.8
db:	CNNVD	id:	CNNVD-202006-1668	Trust: 0.6
db:	OTHER	id:	NONE	Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2020-007376 // CNNVD: CNNVD-202006-1668 // NVD: CVE-2020-10274

REFERENCES

url:	https://github.com/aliasrobotics/rvd/issues/2556	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2020-10274	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-10274	Trust: 0.8
url:	https://ieeexplore.ieee.org/abstract/document/10769424	Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2020-007376 // CNNVD: CNNVD-202006-1668 // NVD: CVE-2020-10274

SOURCES

db:	OTHER	id:	-
db:	JVNDB	id:	JVNDB-2020-007376
db:	CNNVD	id:	CNNVD-202006-1668
db:	NVD	id:	CVE-2020-10274

LAST UPDATE DATE

2025-01-30T20:59:50.870000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2020-007376	date:	2020-08-11T00:00:00
db:	CNNVD	id:	CNNVD-202006-1668	date:	2021-09-15T00:00:00
db:	NVD	id:	CVE-2020-10274	date:	2024-11-21T04:55:06.977

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2020-007376	date:	2020-08-11T00:00:00
db:	CNNVD	id:	CNNVD-202006-1668	date:	2020-06-24T00:00:00
db:	NVD	id:	CVE-2020-10274	date:	2020-06-24T05:15:13.113