CVE-2020-10275: RVD#2565: Weak token generation for the REST API.

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-24 · updated 2026-06-17
Weakness: CWE-261

Description

The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.

Affected products

Easyrobotics Er-Flex Firmware: all versions
Easyrobotics Er-Lite Firmware: all versions
Easyrobotics Er-One Firmware: all versions
Easyrobotics Er200 Firmware: all versions
Mobile-Industrial-Robots Mir1000 Firmware: all versions
Mobile-Industrial-Robots Mir100 Firmware: through 2.8.1.1
Mobile-Industrial-Robots Mir200 Firmware: all versions
Mobile-Industrial-Robots Mir250 Firmware: all versions
Mobile-Industrial-Robots Mir500 Firmware: all versions
Uvd-Robots Uvd Firmware: all versions

References

Get alerted when CVE-2020-10275 or the next vulnerability affects your stack