rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-10270 RVD#2557: Hardcoded Credentials on MiRX00 Control Dashboard
Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcoded IP address. Credentials to such wireless interface default to well known and widely spread users (omitted) and passwords (omitted). This information is also available in past User Guides and manuals which the vendor distributed. This flaw allows cyber attackers to take control of the robot remotely and make use of the default user interfaces MiR has created, lowering the complexity of attacks and making them available to entry-level attackers. More elaborated attacks can also be established by clearing authentication and sending network requests directly. We have confirmed this flaw in MiR100 and MiR200 but according to the vendor, it might also apply to MiR250, MiR500 and MiR1000.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: Mobile Industrial Robots A/S
product: MiR100
Credits: lang: en
value: Alias Robotics (https://aliasrobotics.com/)
Published: 2020-06-24T04:50:18.383Z
CVE-2020-10271 RVD#2555: MiR ROS computational graph is exposed to all network interfaces, including poorly secured wireless networks and open wired ones
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph to all network interfaces, wireless and wired. This is the result of a bad set up and can be mitigated by appropriately configuring ROS and/or applying custom patches as appropriate. Currently, the ROS computational graph can be accessed fully from the wired exposed ports. In combination with other flaws such as CVE-2020-10269, the computation graph can also be fetched and interacted from wireless networks. This allows a malicious operator to take control of the ROS logic and correspondingly, the complete robot given that MiR's operations are centered around the framework (ROS).
Problem types: cwe_id: CWE-668
description: CWE-668
Affected products: vendor: Mobile Industrial Robots A/S
product: MiR100
Credits: lang: en
value: Víctor Mayoral Vilches, Alfonso Glera, Lander Usategui, Unai Ayucar, Xabier Sáez de Cámara (Alias Robotics)
Published: 2020-06-24T04:40:18.659Z
CVE-2020-10272 RVD#2554: MiR ROS computational graph presents no authentication mechanisms
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: Mobile Industrial Robots A/S
product: MiR100
Credits: lang: en
value: Victor Mayoral Vilches, Alfonso Glera, Lander Usategui, Unai Ayucar, Xabier Sáez de Cámara (Alias Robotics)
Published: 2020-06-24T04:35:12.949Z
CVE-2020-10273 RVD#2560: Unprotected intellectual property in Mobile Industrial Robots (MiR) controllers
MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual property artifacts installed in the robots. This flaw allows attackers with access to the robot or the robot network (while in combination with other flaws) to retrieve and easily exfiltrate all installed intellectual property and data.
Problem types: cwe_id: CWE-311
description: CWE-311
Affected products: vendor: Mobile Industrial Robots A/S
product: MiR100
Credits: lang: en
value: Víctor Mayoral Vilches (Alias Robotics)
Published: 2020-06-24T04:55:29.526Z
CVE-2020-10274 RVD#2556: MiR REST API allows for data exfiltration by unauthorized attackers (e.g. indoor maps)
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: Mobile Industrial Robots A/S
product: MiR100
Credits: lang: en
value: Alias Robotics (group, https://aliasrobotics.com)
Published: 2020-06-24T04:40:12.678Z
CVE-2020-10275 RVD#2565: Weak token generation for the REST API.
The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.
Problem types: cwe_id: CWE-261
description: CWE-261
Affected products: vendor: Mobile Industrial Robots A/S
product: MiR100
Credits: lang: en
value: Alias Robotics (group, https://aliasrobotics.com)
Published: 2020-06-24T05:00:26.620Z
CVE-2020-10276 RVD#2558: Default credentials on SICK PLC allows disabling safety features
The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the laser scanner are not affected (thus it is hard to detect before something happens) though the laser scanner configuration can also be affected altering further the safety of the device.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: Mobile Industrial Robots A/S
product: MiR100
Credits: lang: en
value: Bernhard Dieber (Joanneum Research)
Published: 2020-06-24T04:50:14.520Z
CVE-2020-10277 RVD#2562: Booting from a live image leads to exfiltration of sensible information and privilege escalation
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine.
Problem types: cwe_id: CWE-656
description: CWE-656
Affected products: vendor: Mobile Industrial Robots A/S
product: MiR100
Credits: lang: en
value: Lander Usategui, Alfonso Glera (Alias Robotics)
Published: 2020-06-24T04:55:17.409Z
CVE-2020-10278 RVD#2561: Unprotected BIOS allows user to boot from live OS image.
The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order. This can be leveraged by a Malicious operator to boot from a Live Image.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Mobile Industrial Robots A/S
product: MiR100
Credits: lang: en
value: Lander Usategui, Alfonso Glera (Alias Robotics)
Published: 2020-06-24T04:55:22.857Z
CVE-2020-10279 RVD#2569: Insecure operating system defaults in MiR robots
MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents insecure defaults for robots. These insecurities include a way for users to escalate their access beyond what they were granted via file creation, access race conditions, insecure home directory configurations and defaults that facilitate Denial of Service (DoS) attacks.
Problem types: cwe_id: CWE-276
description: CWE-276
Affected products: vendor: Mobile Industrial Robots A/S
product: MiR100
Credits: lang: en
value: Víctor Mayoral Vilches (Alias Robotics)
Published: 2020-06-24T06:05:23.937Z
CVE-2020-10280 RVD#2568: Apache server is vulnerable to a DoS
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard.
Problem types: cwe_id: CWE-239
description: CWE-239
Affected products: vendor: Mobile Industrial Robots A/S
product: MiR100
Credits: lang: en
value: Lander Usategui (Alias Robotics)
Published: 2020-06-24T05:45:13.897Z
CVE-2020-10281 RVD#3315: Cleartext transmission of sensitive information in MAVLink protocol version 1.0 and 2.0
This vulnerability applies to the Micro Air Vehicle Link (MAVLink) protocol and allows a remote attacker to gain access to sensitive information provided it has access to the communication medium. MAVLink is a header-based protocol that does not perform encryption to improve transfer (and reception speed) and efficiency by design. The increasing popularity of the protocol (used accross different autopilots) has led to its use in wired and wireless mediums through insecure communication channels exposing sensitive information to a remote attacker with ability to intercept network traffic.
Problem types: cwe_id: CWE-319
description: CWE-319
Affected products: vendor: unspecified
product: MAVLink
Credits: lang: en
value: None
Published: 2020-07-03T14:30:11.491Z
CVE-2020-10282 RVD#3316: No authentication in MAVLink protocol
The Micro Air Vehicle Link (MAVLink) protocol presents no authentication mechanism on its version 1.0 (nor authorization) whichs leads to a variety of attacks including identity spoofing, unauthorized access, PITM attacks and more. According to literature, version 2.0 optionally allows for package signing which mitigates this flaw. Another source mentions that MAVLink 2.0 only provides a simple authentication system based on HMAC. This implies that the flying system overall should add the same symmetric key into all devices of network. If not the case, this may cause a security issue, that if one of the devices and its symmetric key are compromised, the whole authentication system is not reliable.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: unspecified
product: MAVLink
Credits: lang: en
value: None
Published: 2020-07-03T14:30:15.587Z
CVE-2020-10283 RVD#3317: MAVLink version handshaking allows for an attacker to bypass authentication
The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation, in order to maintain backwards compatibility, GCS and autopilot negotiate the version via the AUTOPILOT_VERSION message. Since this negotiation depends on the answer, an attacker may craft packages in a way that hints the autopilot to adopt version 1.0 of MAVLink for the communication. Given the lack of authentication capabilities in such version of MAVLink (refer to CVE-2020-10282), attackers may use this method to bypass authentication capabilities and interact with the autopilot directly.
Problem types: cwe_id: CWE-288
description: CWE-288
Affected products: vendor: PX4
product: MAVLink
Credits: lang: en
value: Victor Mayoral Vilches (Alias Robotics)
Published: 2020-08-20T08:15:13.054Z
CVE-2020-10284 RVD#3321: No Authentication required to exert manual control of the robot
No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets the user to add a password to the robot but as in xarm_studio 1.3.0 the option is missing from the menu. Assuming manual control, even by forcefully removing the current operator from an active session.
Problem types: cwe_id: CWE-656
description: CWE-656
Affected products: vendor: uFactory
product: xArm5 Lite, xArm 6 and xArm 7
Credits: lang: en
value: Alfonso Glera (Alias Robotics)
Published: 2020-07-15T19:25:13.961Z
CVE-2020-10285 RVD#3322: Weak authentication implementation make the system vulnerable to a brute-force attack over adjacent networks
The authentication implementation on the xArm controller has very low entropy, making it vulnerable to a brute-force attack. There is no mechanism in place to mitigate or lockout automated attempts to gain access.
Problem types: cwe_id: CWE-307
description: CWE-307
Affected products: vendor: uFactory
product: xArm5 Lite, xArm 6 and xArm 7
Credits: lang: en
value: Alfonso Glera (Alias Robotics)
Published: 2020-07-15T21:00:14.468Z
CVE-2020-10286 RVD#3323: Mismanaged permission implementation leads to privilege escalation, exfiltration of sensitive information, and DoS
the main user account has restricted privileges but is in the sudoers group and there is not any mechanism in place to prevent sudo su or sudo -i to be run gaining unrestricted access to sensible files, encryption, or issue orders that disrupt robot operation.
Problem types: cwe_id: CWE-656
description: CWE-656
Affected products: vendor: uFactory
product: xArm 5 Lite, xArm 6 and xArm 7
Credits: lang: en
value: Alfonso Glera (Alias Robotics)
Published: 2020-07-15T21:15:13.859Z
CVE-2020-10287 RVD#3326: Hardcoded default credentials on IRC 5 OPC Server
The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documented functionality that helps customer set up however, out of our research, we found multiple production systems running these exact default credentials and consider thereby this an exposure that should be mitigated. Moreover, future deployments should consider that these defaults should be forbidden (user should be forced to change them).
Problem types: cwe_id: CWE-255
description: CWE-255
Affected products: vendor: ABB
product: IRB140
Credits: lang: en
value: Alfonso Glera, Victor Mayoral Vilches (Alias Robotics)
Published: 2020-07-15T22:15:17.666Z
CVE-2020-10288 RVD#3327: No authentication required for accesing ABB IRC5 FTP server
IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you can input whatever you like. As long as the field isn't empty it will be accepted.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: ABB
product: IRB140
Credits: lang: en
value: Alfonso Glera, Victor Mayoral Vilches (Alias Robotics)
Published: 2020-07-15T22:15:13.640Z
CVE-2020-10289 RVD#2401: Use of unsafe yaml load, ./src/actionlib/tools/library.py:132
Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib, an attacker with local or remote access can make the ROS Master, execute arbitrary code in Python form. Consider yaml.safe_load() instead. Located first in actionlib/tools/library.py:132. See links for more info on the bug.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Open Robotics
product: ros
Credits: lang: en
value: Alias Robotics
Published: 2020-08-20T08:05:14.408Z
CVE-2020-10290 RVD#1495: Universal Robots URCaps execute with unbounded privileges
Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents many primitives that can compromise the overall robot operations as demonstrated in our video. In our PoC we demonstrate how a malicious actor could 'cook' a custom URCap that when deployed by the user (intendedly or unintendedly) compromises the system
Problem types: cwe_id: CWE-250
description: CWE-250 (Execution with Unnecessary Privileges)
Affected products: vendor: Universal Robots
product: URx
Credits: lang: en
value: Victor Mayoral Vilches and Unai Ayucar Carbajo (Alias Robotics)
Published: 2020-08-21T15:05:19.977Z
CVE-2020-10291 RVD#3336: System information disclosure without authentication on KUKA simulators
Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from a network license server. The network license server binds to all interfaces (0.0.0.0) and listensfor packets over UDP port 5093. No authentication/authorization is required in order to communicate with theserver. The protocol being used is a property protocol by RMS Sentinel which provides the licensing infrastructurefor the network license server. RMS Sentinel license manager service exposes UDP port 5093 which provides sensitivesystem information that could be leveraged for further exploitation without any kind of authentication. Thisinformation includes detailed hardware and OS characteristics.After a decryption process, a textual protocol is found which contains a simple header with the requested command,application-identifier, and some arguments. The protocol leaks information regarding the receiving serverinformation, license information and managing licenses, among others.Through this flaw, attackers can retreive information about a KUKA simulation system, particularly, the version ofthe licensing server, which is connected to the simulator, and which will allow them to launch local simulationswith similar characteristics, further understanding the dynamics of motion virtualization and opening doors toother attacks (see RVDP#711 and RVDP#712 for subsequent vulnerabilities that compromise integrity andavailability).Beyond compromising simulations, Visual Components provides capabilities to interface with industrial machinery.Particularly, their PLC Connectivity feature 'makes it easy' to connect simulations with control systems usingeither the industry standard OPC UA or other supported vendor specific interfaces. This fills the gap of jumpingfrom simulation to real and enables attackers to pivot from the Visual Components simulator to robots or otherIndustrial Control System (ICS) devices, such as PLCs.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: KUKA Roboter GmbH
product: Visual Components Network License Server 2.0.8
Credits: lang: en
value: Sharon Brizinov (Claroty)
Published: 2020-11-06T11:20:19.128Z
CVE-2020-10292 Service DoS through arbitrary pointer dereferencing on KUKA simulator
Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from a network license server. The network license server binds to all interfaces (0.0.0.0) and listensfor packets over UDP port 5093. No authentication/authorization is required in order to communicate with theserver. The protocol being used is a property protocol by RMS Sentinel which provides the licensing infrastructurefor the network license server. RMS Sentinel license manager service exposes UDP port 5093 which provides sensitivesystem information that could be leveraged for further exploitation without any kind of authentication. Thisinformation includes detailed hardware and OS characteristics.After a decryption process, a textual protocol is found which contains a simple header with the requested command,application-identifier, and some arguments. The protocol is vulnerable to DoS through an arbitrary pointerderreference. This flaw allows an attacker to to pass a specially crafted package that, when processed by theservice, causes an arbitrary pointer from the stack to be dereferenced, causing an uncaught exception thatterminates the service. This can be further contructed in combination with RVDP#710 which exploits an informationdisclosure leak, or with RVDP#711 for an stack-overflow and potential code execution.Beyond denying simulations, Visual Components provides capabilities to interface with industrial machinery andautomate certain processes (e.g. testing, benchmarking, etc.) which depending on the DevOps setup might beintegrated into the industrial flow. Accordingly, a DoS in the simulation might have higher repercusions, dependingon the Industrial Control System (ICS) ICS infrastructure.
Problem types: cwe_id: CWE-248
description: CWE-248
Affected products: vendor: KUKA Roboter GmbH
product: Visual Components Network License Server 2.0.8
Credits: lang: en
value: Sharon Brizinov (Claroty)
Published: 2020-11-06T11:20:12.790Z
CVE-2020-10364 
The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write system calls, because of uncontrolled resource management.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-23T15:56:19.000Z
CVE-2020-10365 
LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the database. This list could be filtered by modifying some of the parameters. Some of them are not properly sanitized which could allow an authenticated attacker to perform arbitrary queries to the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-18T21:24:09.000Z
CVE-2020-10366 
LogicalDoc before 8.3.3 allows /servlet.gupld Directory Traversal, a different vulnerability than CVE-2020-9423 and CVE-2020-10365.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T23:58:00.000Z
CVE-2020-10367 
Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory access via a "Spectra" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-10T00:00:00.000Z
CVE-2020-10368 
Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory read access via a "Spectra" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-10T00:00:00.000Z
CVE-2020-10369 
Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow inferences about memory content via a "Spectra" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-10T00:00:00.000Z
CVE-2020-10370 
Certain Cypress (and Broadcom) Wireless Combo chips such as CYW43455, when a 2021-01-26 Bluetooth firmware update is not present, allow a Bluetooth outage via a "Spectra" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-10T00:00:00.000Z
CVE-2020-10372 
Ramp AltitudeCDN Altimeter before 2.4.0 allows authenticated Stored XSS via the vdms/ipmapping.jsp location field to the dms/rest/services/datastore/createOrEditValueForKey URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T20:26:32.000Z
CVE-2020-10374 
A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows unauthenticated remote command execution via a crafted POST request or the what parameter of the screenshot function in the Contact Support form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-30T21:18:13.000Z
CVE-2020-10375 
An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format that can be easily reversed. The file data.mdb contains these obfuscated passwords in the second column. NOTE: this is unrelated to the popular Smarty template engine product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-05T19:26:48.000Z
CVE-2020-10376 
Technicolor TC7337NET 08.89.17.23.03 devices allow remote attackers to discover passwords by sniffing the network for an "Authorization: Basic" HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-11T13:35:02.000Z
CVE-2020-10377 
A weak encryption vulnerability in Mitel MiVoice Connect Client before 214.100.1214.0 could allow an unauthenticated attacker to gain access to user credentials. A successful exploit could allow an attacker to access the system with compromised user credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T12:31:49.000Z