CVE-2020-10275 - CVE House
Back to Database
Status published Critical CVE-2020-10275

RVD#2565: Weak token generation for the REST API.

Vulnerability Description

The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-10275

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Alias Robotics (group, https://aliasrobotics.com)

References

More from Mobile Industrial Robots A/S

View All →
CVE-2020-10280
RVD#2568: Apache server is vulnerable to a DoS
High 8.2
CVE-2020-10279
RVD#2569: Insecure operating system defaults in MiR robots
Critical 10
CVE-2020-10278
RVD#2561: Unprotected BIOS allows user to boot from live OS image.
Medium 6.1
CVE-2020-10277
RVD#2562: Booting from a live image leads to exfiltration of sensible information and privilege escalation
Medium 6.4
CVE-2020-10276
RVD#2558: Default credentials on SICK PLC allows disabling safety features
Critical 9.8

Affected Vendor

Mobile Industrial Robots A/S

View all reports →

Affected Software

MiR100
Vulnerable Versions:
v2.8.1.1 and before

Timeline

Official Publish: June 24th, 2020
Last Modified: September 16th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-261

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.