CVE-2020-10269: RVD#2566: Hardcoded Credentials on MiRX00 wireless Access Point
One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in WiFi Master (Access Point) mode. Credentials to such wireless Access Point default to well known and widely spread SSID (MiRRXXXX) and passwords (omitted). This information is also available in past User Guides and manuals which the vendor distributed. We have confirmed this flaw in MiR100 and MiR200 but it might also apply to MiR250, MiR500 and MiR1000.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-10269?
CVE-2020-10269 is a vulnerability that affects wireless interfaces in MiR100, MiR200, and other MiR fleet vehicles, allowing unauthorized access to the wireless Access Point.
What is the severity of CVE-2020-10269?
CVE-2020-10269 has a severity score of 9.8, which is considered critical.
Which software versions are affected by CVE-2020-10269?
CVE-2020-10269 affects Aliasrobotics Mir100 Firmware version up to and including 2.8.1.1, Aliasrobotics Mir200 Firmware version up to and including 2.8.1.1, Aliasrobotics Mir250 Firmware version up to and including 2.8.1.1, Aliasrobotics Mir500 Firmware version up to and including 2.8.1.1, Aliasrobotics Mir1000 Firmware version up to and including 2.8.1.1, Mobile-industrial-robotics Er200 Firmware version up to and including 2.8.1.1, Enabled-robotics Er-lite Firmware version up to and including 2.8.1.1, Enabled-robotics Er-flex Firmware version up to and including 2.8.1.1, and Enabled-robotics Er-one Firmware version up to and including 2.8.1.1.
How can the CVE-2020-10269 vulnerability be exploited?
CVE-2020-10269 can be exploited by using the default well-known SSID (MiR_RXXXX) and passwords to gain unauthorized access to the wireless Access Point in MiR100, MiR200, and other affected MiR fleet vehicles.
Are there any fixes available for CVE-2020-10269?
At the moment, there are no known fixes or patches available for CVE-2020-10269. It is recommended to follow the vendor's advisory and best practices to mitigate the risk.