CVE-2020-10272
Status: ModifiedCritical (9.8)—
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Base score: 9.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 2.46%
- Percentile among all scored CVEs: 84
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (10)
Aliasrobotics — Mir1000 FirmwareAliasrobotics — Mir100 FirmwareAliasrobotics — Mir200 FirmwareAliasrobotics — Mir250 FirmwareAliasrobotics — Mir500 FirmwareEnabled-robotics — Er-flex FirmwareEnabled-robotics — Er-lite FirmwareEnabled-robotics — Er-one FirmwareMobile-industrial-robotics — Er200 FirmwareUvd-robots — UVD Robots Firmware
CWEs
- CWE-306
- CWE-306
References
Raw JSON (NVD)
Show
{
"id": "CVE-2020-10272",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "cve@aliasrobotics.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.0",
"baseScore": 10,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 3.9
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@aliasrobotics.com",
"affectedData": [
{
"vendor": "Mobile Industrial Robots A/S",
"product": "MiR100",
"versions": [
{
"status": "affected",
"version": "v2.8.1.1 and before"
}
]
}
]
}
],
"published": "2020-06-24T05:15:12.943",
"references": [
{
"url": "https://github.com/aliasrobotics/RVD/issues/2554",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "cve@aliasrobotics.com"
},
{
"url": "https://github.com/aliasrobotics/RVD/issues/2554",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "cve@aliasrobotics.com",
"description": [
{
"lang": "en",
"value": "CWE-306"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-306"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire."
},
{
"lang": "es",
"value": "MiR100, MiR200 y otros robots MiR usan los paquetes predeterminados del Robot Operating System (ROS) que exponen el gráfico computacional sin ningún tipo de autenticación. Esto permite a atacantes con acceso a las redes inalámbricas y cableadas internas tomar el control del robot perfectamente. En combinación con CVE-2020-10269 y CVE-2020-10271, este fallo permite a actores maliciosos comandar el robot cuando lo deseen"
}
],
"lastModified": "2026-06-17T02:47:36.200",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:aliasrobotics:mir100_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BBDEDA2D-26AB-4F23-B672-D0C89A7BEFB9",
"versionEndIncluding": "2.8.1.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:aliasrobotics:mir100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D0989373-02AB-4E05-BAC2-0522A641D73A"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:aliasrobotics:mir200_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78E261B1-C56F-4428-9D53-5BBCCACEAFCF",
"versionEndIncluding": "2.8.1.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:aliasrobotics:mir200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7BF40B1F-0DD2-4B8A-BFBA-A7E641DC3316"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:aliasrobotics:mir250_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "877EEDC4-E86F-420D-81C6-3F632C787003",
"versionEndIncluding": "2.8.1.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:aliasrobotics:mir250:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BD1AE2A0-D83D-441B-856B-7E6FAB065C0D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:aliasrobotics:mir500_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "335CA5FE-5AFD-4D49-9A88-1CD71C9281BE",
"versionEndIncluding": "2.8.1.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:aliasrobotics:mir500:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F57611E0-5CB2-40FD-8420-ED13A1C4863F"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:aliasrobotics:mir1000_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6865A559-8CA9-4F51-AC43-35BDF5201B91",
"versionEndIncluding": "2.8.1.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:aliasrobotics:mir1000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "04043B16-E401-4D2C-9812-71923CEA2716"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robotics:er200_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39BD42AA-95E1-4A02-BB9D-C54AE6BAF9B2",
"versionEndIncluding": "2.8.1.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robotics:er200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D8A47E5E-7754-47EA-B02D-8A7F54124ED4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:enabled-robotics:er-lite_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DF0E5CFB-6C15-4BB1-97D8-DD52F68190DD",
"versionEndIncluding": "2.8.1.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:enabled-robotics:er-lite:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "472A560B-547D-4C9F-BE86-ED602FA32799"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:enabled-robotics:er-flex_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D5528AFD-75DF-4296-9A29-4BD00AB76273",
"versionEndIncluding": "2.8.1.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:enabled-robotics:er-flex:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "654488E4-161E-40B5-9E0B-BE68F5F38E91"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:enabled-robotics:er-one_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CD6E62F4-9C15-49AA-BFB7-81443D40B9B9",
"versionEndIncluding": "2.8.1.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:enabled-robotics:er-one:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1BB77317-78C0-4800-8E1D-498979B6CB06"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:uvd-robots:uvd_robots_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7452D74-36A5-4C87-AA20-8E9A80724EAA",
"versionEndIncluding": "2.8.1.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:uvd-robots:uvd_robots:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4FD4ACEB-1184-47AB-86E4-732DA183E8AE"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@aliasrobotics.com"
}