Security readout for executives and security teams
Plain-English summary
This CVE is a confidentiality failure in Mobile Industrial Robots MiR100 controllers. Firmware v2.8.1.1 and earlier does not protect installed intellectual property artifacts, so an attacker who can reach the robot or robot network, especially with other flaws, may retrieve and exfiltrate that data.
Executive priority
Treat this as high priority if MiR100 robots store proprietary workflows, maps, configurations, or operational data. The main business risk is loss of intellectual property and sensitive robot data, not system takeover based on the provided evidence.
Technical view
CVE-2020-10273 is CWE-311: missing encryption or protection of sensitive artifacts on MiR100 controllers. The CVSS 3.0 score is 7.5, with network attack vector, low complexity, no privileges, no user interaction, and high confidentiality impact. Integrity and availability impacts are not identified in the source bundle.
Likely exposure
Organizations operating Mobile Industrial Robots MiR100 on firmware v2.8.1.1 or earlier are the stated exposure group. Risk is higher where robots are reachable from broader corporate, wireless, vendor, or poorly segmented OT networks.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. The described attack context requires access to the robot or robot network and may rely on combination with other flaws.
Researcher notes
The available evidence supports a confidentiality issue caused by unprotected artifacts. Do not infer broader MiR product impact beyond the stated MiR100 entry. No exploit-in-the-wild claim or named patch is present in the provided bundle.
Mitigation direction
- Inventory MiR100 robots and record controller firmware versions.
- Check MiR vendor guidance for fixed firmware or official compensating controls.
- Restrict robot network access to required operators, services, and maintenance paths.
- Segment robot networks from corporate, guest, and internet-reachable networks.
- Review whether sensitive IP artifacts must reside on affected robots.
Validation and detection
- Confirm whether any MiR100 controllers run firmware v2.8.1.1 or earlier.
- Map all network paths that can reach affected robot controllers.
- Review access controls around robot management and maintenance interfaces.
- Check logs or monitoring for unusual robot access or data transfer patterns.
- Document any vendor-approved firmware updates or compensating controls applied.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-311: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-10273 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
7.5HighVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/aliasrobotics/RVD/issues/2560CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Encryption of Sensitive Data
Missing Encryption of Sensitive Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.