Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2020-10275

RVD#2565: Weak token generation for the REST API.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Alias

Description

The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mobile Industrial Robots A/S MiR100

  • v2.8.1.1 and beforeaffected

References