CVE Feed

    Dashboard / CVE / CVE-2025-8748

    CVE-2025-8748

    MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious HTTP request crafted by an authenticated user could allow the execution of arbitrary commands on the underlying operating system.

    Published:Aug 8, 2025
    Last Modified:Apr 15, 2026
    EPS:Aug 8, 2025
    EPSS Score:0.00306
    CVSS Score:8.8

    Affected Products

    Vendor
    Mobile-industrial-robots
    Product
    Mir100
    Vendor
    Mobile-industrial-robots
    Product
    Mir1000
    Vendor
    Mobile-industrial-robots
    Product
    Mir200
    Vendor
    Mobile-industrial-robots
    Product
    Mir250
    Vendor
    Mobile-industrial-robots
    Product
    Mir500

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-9229 (CVSS 5.3) — Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthent…
    CVE-2025-9228 (CVSS 4.3) — MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes…
    CVE-2025-9225 (CVSS 5.5) — Stored cross-site scripting (XSS) in the web interface of MiR software versions prior to 3.0.0 on MiR Robots a…
    CVE-2025-8749 (CVSS 6.5) — Path Traversal vulnerability in API Endpoint in Mobile Industrial Robots (MiR) Software Versions prior to 3.0.…
    CVE-2020-10280 (CVSS 7.5) — The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP he…
    CVE-2020-10275 (CVSS 9.8) — The access tokens for the REST API are directly derived from the publicly available default credentials for th…
    CVE-2020-10277 (CVSS 6.4) — There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extrac…
    CVE-2020-10276 (CVSS 9.8) — The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipul…
    CVE-2020-10274 (CVSS 7.1) — The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly availab…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High