CVE-2025-8749
📋 TL;DR
This path traversal vulnerability in MiR robot software allows authenticated users to access arbitrary files on the robot's file system through specially crafted API requests. It affects MiR industrial robots running software versions before 3.0.0, potentially exposing sensitive configuration files, logs, or credentials.
💻 Affected Systems
- Mobile Industrial Robots (MiR) Robots
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could extract sensitive system files, configuration data, or credentials, potentially enabling further attacks, data theft, or operational disruption of industrial robots.
Likely Case
Authenticated users or compromised accounts accessing sensitive robot configuration files, potentially leading to operational insights or preparation for further attacks.
If Mitigated
Limited impact with proper authentication controls, network segmentation, and monitoring in place to detect unusual file access patterns.
🎯 Exploit Status
Requires authentication and knowledge of API endpoints; path traversal techniques are well-documented
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.0 or later
Vendor Advisory: https://mobile-industrial-robots.com/security-advisories/path-traversal
Restart Required: No
Instructions:
1. Access MiR robot management interface
2. Check current software version
3. If below 3.0.0, download and install version 3.0.0 or later from MiR support portal
4. Verify installation completes successfully
🔧 Temporary Workarounds
API Access Restriction
allRestrict access to vulnerable API endpoints using network controls or web application firewall rules
Authentication Strengthening
allImplement strong authentication controls and monitor for unusual API access patterns
🧯 If You Can't Patch
- Segment MiR robot network from other systems to limit lateral movement
- Implement strict access controls and monitoring for authenticated API requests
🔍 How to Verify
Check if Vulnerable:
Check MiR robot software version via management interface or API; if version is below 3.0.0, system is vulnerableCheck Version:
Check via MiR web interface or API endpoint for version informationVerify Fix Applied:
Confirm software version is 3.0.0 or higher via management interface📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in API logs
- Multiple failed path traversal attempts
- Access to sensitive file paths via API
Network Indicators:
- Unusual API request patterns with path traversal sequences
- Requests to sensitive file paths
SIEM Query:
source="mir_api" AND (uri CONTAINS "../" OR uri CONTAINS "..\" OR uri MATCHES "/etc/|/var/|/root/")