RVD#14: Insecure transport in SoftBank's Pepper and NAO robot's Qi Protocol

[aliasbot]

{
    "id": 14,
    "title": "RVD#14: Insecure transport in SoftBank's Pepper and NAO robot's Qi Protocol",
    "type": "vulnerability",
    "description": "Insecure transport in SoftBank's Pepper and NAO robot's Qi Protocol could allow man-in-the-middle attackers to eavesdrop sensitive information or affect integrity of sent data.On all versions.",
    "cwe": "CWE-319",
    "cve": "N/A",
    "keywords": [
        "robot: NAO",
        "robot: Pepper",
        "severity: critical",
        "vendor: SoftBank Robotics",
    ],
    "system": "NAO / Pepper",
    "vendor": "SoftBank Robotics",
    "severity": {
        "rvss-score": "7.5",
        "rvss-vector": "RVSS:1.0/AV:IN/AC:L/PR:N/UI:N/Y:M/S:U/C:H/I:L/A:L/H:U",
        "severity-description": "High",
        "cvss-score": "8.6",
        "cvss-vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/"
    },
    "links": [
        "https://github.com/aliasrobotics/RVD/issues/14"
    ],
    "flaw": {
        "phase": "testing",
        "specificity": "general-issue",
        "architectural-location": "platform code",
        "application": "NaoQi",
        "subsystem": "HTTP communication layer",
        "package": "N/A",
        "languages": "None",
        "date-detected": "2017-03-01",
        "detected-by": "Cesar Cerrudo and Lucas Apa from IOActive",
        "detected-by-method": "Testing dynamic",
        "date-reported": "2017-03-01",
        "reported-by": "Alias Robotics",
        "reported-by-relationship": "Security researcher",
        "issue": "https://github.com/aliasrobotics/RVD/issues/14",
        "reproducibility": "Always",
        "trace": "N/A",
        "reproduction": "N/A",
        "reproduction-image": "N/A"
    },
    "exploitation": {
        "description": "N/A",
        "exploitation-image": "N/A",
        "exploitation-vector": "N/A"
    },
    "mitigation": {
        "description": "N/A",
        "pull-request": "N/A",
        "date-mitigation": null
    }
}

[github-actions[bot]]

Feedback (automatically generated):

• FIXME: Flaw not identified as a vulnerability, weakness or exposure. Have you included # Vulnerability (or Weakness or Exposure) report at the top of the ticket?, see for more information or review other tickets to get inspiration

Please review the feedback above. Once addressed, either request the removal of the malformed label to trigger another automatic review.

[github-actions[bot]]

Feedback (automatically generated):

• FIXME: Robot or Robot component not present in summary table or invalid, see for more information or review other tickets and get inspiration

Please review the feedback above. Once addressed, either request the removal of the malformed label to trigger another automatic review.

[glerapic]

Triage Completed.