← CVE Intelligence

CVE-2020-10275

RVD#2565: Weak token generation for the REST API. PUBLISHED

Description (CNA)

The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.

Affected (CNA)

Vendor / productVersions
Mobile Industrial Robots A/S / MiR100affected v2.8.1.1 and before

CWE

CWE-261

References

ADP enrichment

CVE

No English description supplied.