Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2025-9229

Information Disclosure in MiR robots and MiR fleet through verbose error pages

Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detailed error information, such as file paths and other data, via access to verbose error pages.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mobile-industrial-robots
Products
Mir100 Mir1000 Mir200 and 2 more
CVE-2025-8748

OS command injection in MiR robots and MiR fleet via crafted HTTP requests

MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious HTTP request crafted by an authenticated user could allow the execution of arbitrary commands on the underlying operating system.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Mobile-industrial-robots
Products
Mir100 Mir1000 Mir200 and 2 more
CVE-2025-8749

Path traversal vulnerability in MiR robot software via API requests

Path Traversal vulnerability in API Endpoint in Mobile Industrial Robots (MiR) Software Versions prior to 3.0.0 on MiR Robots allows authenticated users to extract files from the robot file system via a crafted API request.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mobile-industrial-robots
Products
Mir100 Mir1000 Mir200 and 2 more
CVE-2025-9225

Cross-site scripting (XSS) in MiR robots and MiR fleet

Stored cross-site scripting (XSS) in the web interface of MiR software versions prior to 3.0.0 on MiR Robots and MiR Fleet allows execution of arbitrary JavaScript code in a victim’s browser

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mobile-industrial-robots
Products
Mir100 Mir1000 Mir200 and 2 more
CVE-2025-9228

Insufficient authorization when creating notes

MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes which are intended only for administrative users.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mobile-industrial-robots
Products
Mir100 Mir1000 Mir200 and 2 more
CVE-2020-10277

RVD#2562: Booting from a live image leads to exfiltration of sensible information and privilege escalation

There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Easyrobotics Mobile-industrial-robots Uvd-robots
Products
Er-flex Er-flex Firmware Er-lite and 17 more
CVE-2020-10276

RVD#2558: Default credentials on SICK PLC allows disabling safety features

The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the laser scanner are not affected (thus it is hard to detect before something happens) though the laser scanner configuration can also be affected altering further the safety of the device.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Easyrobotics Mobile-industrial-robots Uvd-robots
Products
Er-flex Er-flex Firmware Er-lite and 17 more
CVE-2020-10275

RVD#2565: Weak token generation for the REST API.

The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Easyrobotics Mobile-industrial-robots Uvd-robots
Products
Er-flex Er-flex Firmware Er-lite and 17 more
CVE-2020-10274

RVD#2556: MiR REST API allows for data exfiltration by unauthorized attackers (e.g. indoor maps)

The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Easyrobotics Mobile-industrial-robots Uvd-robots
Products
Er-flex Er-flex Firmware Er-lite and 17 more