CVE-2025-9228
Insufficient authorization when creating notes
- Published
- Updated
- Reserved
- Assigned by
- TRO
Description
MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes which are intended only for administrative users.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| TROCNA (assigner) | 3.1 | Medium4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| NVDNVD · Deferred | 3.1 | Medium4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.21% · top 89% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.
Weakness
Affected products
Mobile Industrial Robots · MiR Robots
- affected < 3.0.0
Mobile Industrial Robots · MiR Fleet
- affected < 3.0.0
What to do
Solution: Update to the newest software version, at least version 3.0.0
Workaround: If you cannot immediately update to the recommended version, we recommend the following compensating measures: 1. Operate the MiR system in a segmented and secured network with strict firewall rules 2. Secure user accounts on the MiR system as recommended in the MiR Cybersecurity Guide
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-9228)Record last updated .