TI-2020-08283 CVE-2020-10276 · GHSA-f572-w4j4-f6r5
RVD#2558: Default credentials on SICK PLC allows disabling safety features
Priority MEDIUM 45
The password for the safety PLC is the default and thus easy to find (in manuals, etc.).
Easyrobotics
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Easyrobotics records in CISA KEVNo Easyrobotics vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records in Er-one Firmware · all components
TI-2020-08282 CVE-2020-10275 · GHSA-3rpj-mvwg-494q
RVD#2565: Weak token generation for the REST API.
Priority MEDIUM 44
The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface.
TI-2020-08287 CVE-2020-10280 · GHSA-4wc2-6jq7-xfqf
RVD#2568: Apache server is vulnerable to a DoS
Priority LOW 35
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard.
TI-2020-08281 CVE-2020-10274 · GHSA-8839-62pg-36q3
RVD#2556: MiR REST API allows for data exfiltration by unauthorized attackers (e.g. indoor maps)
Priority LOW 33
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws).
TI-2020-08284 CVE-2020-10277 · GHSA-6635-xfqx-gr6m
RVD#2562: Booting from a live image leads to exfiltration of sensible information and privilege escalation
Priority LOW 29
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with su…