CVE-2020-10276

RVD#2558: Default credentials on SICK PLC allows disabling safety features

State: Published
Severity: 9.8 Critical
Published: Jun 24, 2020
Updated: Sep 16, 2024
Reserved: Mar 10, 2020

Description

The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the laser scanner are not affected (thus it is hard to detect before something happens) though the laser scanner configuration can also be affected altering further the safety of the device.

Scores

CVSS	Score	Vector	Source
3.0	9.8 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Alias

Weaknesses

CWE-798

Affected Products

Product	Versions
MiR100Mobile Industrial Robots A/S	v2.8.1.1 and beforeAffected

References

https://github.com/aliasrobotics/RVD/issues/2558

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.