CVE-2020-10274: RVD#2556: MiR REST API allows for data exfiltration by unauthorized attackers (e.g. indoor maps)

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-24 · updated 2026-06-17
Weakness: CWE-200

Description

The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.

Affected products

Easyrobotics Er-Flex Firmware: all versions
Easyrobotics Er-Lite Firmware: all versions
Easyrobotics Er-One Firmware: all versions
Easyrobotics Er200 Firmware: all versions
Mobile-Industrial-Robots Mir1000 Firmware: all versions
Mobile-Industrial-Robots Mir100 Firmware: through 2.8.1.1
Mobile-Industrial-Robots Mir200 Firmware: all versions
Mobile-Industrial-Robots Mir250 Firmware: all versions
Mobile-Industrial-Robots Mir500 Firmware: all versions
Uvd-Robots Uvd Firmware: all versions

References

Get alerted when CVE-2020-10274 or the next vulnerability affects your stack