CVE Feed

    Dashboard / CVE / CVE-2025-9228

    CVE-2025-9228

    MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes which are intended only for administrative users.

    Published:Aug 20, 2025
    Last Modified:Apr 15, 2026
    EPS:Aug 20, 2025
    EPSS Score:0.00036
    CVSS Score:4.3

    Affected Products

    Vendor
    Mobile-industrial-robots
    Product
    Mir100
    Vendor
    Mobile-industrial-robots
    Product
    Mir1000
    Vendor
    Mobile-industrial-robots
    Product
    Mir200
    Vendor
    Mobile-industrial-robots
    Product
    Mir250
    Vendor
    Mobile-industrial-robots
    Product
    Mir500

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-9229 (CVSS 5.3) — Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthent…
    CVE-2025-9225 (CVSS 5.5) — Stored cross-site scripting (XSS) in the web interface of MiR software versions prior to 3.0.0 on MiR Robots a…
    CVE-2025-8749 (CVSS 6.5) — Path Traversal vulnerability in API Endpoint in Mobile Industrial Robots (MiR) Software Versions prior to 3.0.…
    CVE-2025-8748 (CVSS 8.8) — MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious H…
    CVE-2020-10280 (CVSS 7.5) — The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP he…
    CVE-2020-10275 (CVSS 9.8) — The access tokens for the REST API are directly derived from the publicly available default credentials for th…
    CVE-2020-10277 (CVSS 6.4) — There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extrac…
    CVE-2020-10276 (CVSS 9.8) — The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipul…
    CVE-2020-10274 (CVSS 7.1) — The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly availab…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High