Ghost Robotics Vision 60 Authentication Vulnerability in Network and USB Interfaces

A vulnerability exists in Ghost Robotics Vision 60 version 0.27.2, allowing unauthorized access to the robot's network through its physical interfaces, which include three RJ45 connectors and a USB Type-C port. The robot's internal router automatically assigns IP addresses to devices connected via these ports. This lack of authentication enables an attacker to connect a WiFi access point to the robot's network without needing the deployed network credentials. Once connected, the attacker can monitor the robot's data, as it operates on ROS 2 without default authentication.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the robot's network, allowing an attacker to intercept and monitor data transmitted by the robot, which could be used to exploit other vulnerabilities or manipulate the robot's actions.