CVE Feed

    Dashboard / CVE / CVE-2025-9225

    CVE-2025-9225

    Stored cross-site scripting (XSS) in the web interface of MiR software versions prior to 3.0.0 on MiR Robots and MiR Fleet allows execution of arbitrary JavaScript code in a victim’s browser

    Published:Aug 20, 2025
    Last Modified:Apr 15, 2026
    EPS:Aug 20, 2025
    EPSS Score:0.00048
    CVSS Score:5.5

    Affected Products

    Vendor
    Mobile-industrial-robots
    Product
    Mir100
    Vendor
    Mobile-industrial-robots
    Product
    Mir1000
    Vendor
    Mobile-industrial-robots
    Product
    Mir200
    Vendor
    Mobile-industrial-robots
    Product
    Mir250
    Vendor
    Mobile-industrial-robots
    Product
    Mir500

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-9229 (CVSS 5.3) — Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthent…
    CVE-2025-9228 (CVSS 4.3) — MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes…
    CVE-2025-8749 (CVSS 6.5) — Path Traversal vulnerability in API Endpoint in Mobile Industrial Robots (MiR) Software Versions prior to 3.0.…
    CVE-2025-8748 (CVSS 8.8) — MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious H…
    CVE-2020-10280 (CVSS 7.5) — The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP he…
    CVE-2020-10275 (CVSS 9.8) — The access tokens for the REST API are directly derived from the publicly available default credentials for th…
    CVE-2020-10277 (CVSS 6.4) — There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extrac…
    CVE-2020-10276 (CVSS 9.8) — The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipul…
    CVE-2020-10274 (CVSS 7.1) — The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly availab…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High