RVD#2554: MiR ROS Rechengraph weist keine Authentifizierungsmechanismen auf

The primary impact of CVE-2020-10272 is the potential for unauthorized control of MiR robots. An attacker with access to the robot's internal wireless or wired network can exploit this vulnerability to seamlessly command the robot, potentially disrupting operations, causing physical damage, or even using the robot for malicious purposes. This vulnerability is particularly concerning given the increasing use of robots in industrial and logistics environments where they often operate autonomously. The lack of authentication means that any device on the network could potentially exploit this flaw. Combined with CVE-2020-10269 and CVE-2020-10271, the attack surface expands significantly, allowing for more complex and potentially devastating attacks.

Organizations utilizing MiR robots in manufacturing, logistics, or warehousing environments are at risk. This includes facilities with shared internal networks, legacy robot deployments without network segmentation, and those relying on default ROS configurations without proper security hardening. Any environment where robots interact with sensitive data or critical infrastructure is particularly vulnerable.

• linux / server: Monitor network traffic for unusual connections to the robot's ROS services. Use ss or lsof to identify processes listening on exposed ports.

ss -tulnp | grep :11311 # ROS Master port

• linux / server: Examine system logs (journalctl) for authentication failures or unauthorized access attempts to ROS services.

journalctl -u ros_master | grep -i authentication

• generic web: Check for exposed ROS endpoints by attempting to access them via curl.

curl http://<robot_ip>:11311/get_node_info

1. 2020-06-24Disclosure

   disclosure

2. 2020-06-24Patch

   patch

1. Reserviert2020-03-10
2. Veröffentlicht2020-06-24
3. Geändert2024-09-17
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2020-10272 is to upgrade affected MiR robots to version 2.8.2 or later, which includes the necessary authentication mechanisms to protect the computational graph. If an immediate upgrade is not possible, consider segmenting the robot's network to restrict access to only authorized devices. Implementing network intrusion detection systems (IDS) and monitoring network traffic for suspicious activity can also help detect and prevent exploitation attempts. Review and strengthen network security policies to ensure only trusted devices can access the robot's network. After upgrading, confirm the fix by attempting to access the computational graph from an unauthorized network device; access should be denied.