TI-2025-08457 Aliases CVE-2025-9225 GHSA-hxwp-fxc7-p9c4

Cross-site scripting (XSS) in MiR robots and MiR fleet

LOW 24CWE-79Published 2025-08-20 · Updated 2025-11-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Stored cross-site scripting (XSS) in the web interface of MiR software versions prior to 3.0.0 on MiR Robots and MiR Fleet allows execution of arbitrary JavaScript code in a victim’s browser

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00264 18th percentileScored 2026-11-07

Fix Fixed MiR Robots (Mobile Industrial Robots): 3.0.0MiR Fleet (Mobile Industrial Robots): 3.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Mobile Industrial Robots A/S	MiR Robots	before 3.0.0	3.0.0	Patch available	CNA
Mobile Industrial Robots A/S	MiR Fleet	before 3.0.0	3.0.0	Patch available	CNA

MiR Robots VendorMobile Industrial Robots A/S Affected before 3.0.0 Fixed in 3.0.0 Patch available CNA
MiR Fleet VendorMobile Industrial Robots A/S Affected before 3.0.0 Fixed in 3.0.0 Patch available CNA

Remediation

Fix · CNA MiR Robots (Mobile Industrial Robots) Fixed in 3.0.0
Fix · CNA MiR Fleet (Mobile Industrial Robots) Fixed in 3.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-08-20
Mobile Industrial Robots MiR Fleet, MiR Robots 3.0.0
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2025-08461 Information Disclosure in MiR robots and MiR fleet through verbose error pagesPriority LOW 24
- TI-2025-08460 Insufficient authorization when creating notesPriority LOW 19
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-9225
2026-10-03 Alias added: GHSA-hxwp-fxc7-p9c4

References

Advisory 1

https://mobile-industrial-robots.com/security-advisories/cross-site-scripting

Other 1

https://supportportal.mobile-industrial-robots.com/documentation/mir-cybersecurity-guide/mir-cybersecurity-guide/

TI-2020-08279 RVD#2554: MiR ROS computational graph presents no authentication mechanisms CVSS 3.1CRITICAL 9.8
TI-2020-08278 Exposure of resource to wrong sphere in Mobile Industrial Robots A/S MiR100 CVSS 3.1CRITICAL 9.8
TI-2020-08283 RVD#2558: Default credentials on SICK PLC allows disabling safety features CVSS 3.1CRITICAL 9.8
TI-2020-08277 RVD#2557: Hardcoded Credentials on MiRX00 Control Dashboard CVSS 3.1CRITICAL 9.8
TI-2020-08276 RVD#2566: Hardcoded Credentials on MiRX00 wireless Access Point CVSS 3.1CRITICAL 9.8
TI-2020-08286 RVD#2569: Insecure operating system defaults in MiR robots CVSS 3.1CRITICAL 9.8

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences