CVE-2020-10279

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents insecure defaults for robots. These insecurities include a way for users to escalate their access beyond what they were granted via file creation, access race conditions, insecure home directory configurations and defaults that facilitate Denial of Service (DoS) attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276CWE-362CWE-1188

Affected software

VendorProductVersions
Mobile Industrial Robots A/SMiR100v2.8.1.1 and before

References

Timeline

Published
Jun 24, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-10287.8A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exCVE-2020-102807.5The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking thCVE-2020-102817.5This vulnerability applies to the Micro Air Vehicle Link (MAVLink) protocol and allows a remote attacker to gain access to sensitive informaCVE-2020-102829.8The Micro Air Vehicle Link (MAVLink) protocol presents no authentication mechanism on its version 1.0 (nor authorization) whichs leads to a CVE-2020-102839.8The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation, CVE-2020-102849.1No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets theCVE-2020-102859.8The authentication implementation on the xArm controller has very low entropy, making it vulnerable to a brute-force attack. There is no mecCVE-2020-102868.8the main user account has restricted privileges but is in the sudoers group and there is not any mechanism in place to prevent sudo su or suCVE-2020-102879.8The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers thCVE-2020-102889.8IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however youCVE-2020-102898.8Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happCVE-2020-10297.8An elevation of privilege vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, aka
CVE-2020-10279: Critical severity, CVSS 9.8 | Vulnix