CVE-2020-10275: RVD#2565: Weak token generation for the REST API.
The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-10275?
CVE-2020-10275 is a vulnerability that allows an unauthorized attacker inside the network to use default credentials to generate access tokens for the REST API.
What is the severity of CVE-2020-10275?
CVE-2020-10275 has a severity rating of 9.8, which is classified as critical.
Which software is affected by CVE-2020-10275?
The affected software includes Mobile-industrial-robots Mir100 Firmware (up to version 2.8.1.1) and Mobile-industrial-robots Mir200, Mir250, Mir500, Mir1000 Firmware. Easyrobotics Er200, Er-lite, Er-flex, Er-one Firmware, and Uvd-robots Uvd Firmware are also affected.
How can an attacker exploit CVE-2020-10275?
An attacker inside the network can use the default credentials to generate access tokens for the REST API, bypassing authentication and gaining unauthorized access.
Is there a fix for CVE-2020-10275?
To fix CVE-2020-10275, it is recommended to update the affected software to a version that addresses this vulnerability or implement alternate authentication mechanisms to secure the REST API.