CVE-2020-10277 - CVE House
Back to Database
Status published Medium CVE-2020-10277

RVD#2562: Booting from a live image leads to exfiltration of sensible information and privilege escalation

Vulnerability Description

There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-10277

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Lander Usategui, Alfonso Glera (Alias Robotics)

References

More from Mobile Industrial Robots A/S

View All →
CVE-2020-10280
RVD#2568: Apache server is vulnerable to a DoS
High 8.2
CVE-2020-10279
RVD#2569: Insecure operating system defaults in MiR robots
Critical 10
CVE-2020-10278
RVD#2561: Unprotected BIOS allows user to boot from live OS image.
Medium 6.1
CVE-2020-10276
RVD#2558: Default credentials on SICK PLC allows disabling safety features
Critical 9.8
CVE-2020-10275
RVD#2565: Weak token generation for the REST API.
Critical 9.8

Affected Vendor

Mobile Industrial Robots A/S

View all reports →

Affected Software

MiR100
Vulnerable Versions:
v2.8.1.1 and before

Timeline

Official Publish: June 24th, 2020
Last Modified: September 17th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Weaknesses (CWE)

CWE-656

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.