Alfonso

Results 9 comments of Alfonso

RVD#10: Relative Path Traversal vulnerability in SREA-01 and SREA-50

Ticket Updated. Requesting peer review.

RVD#3315: Cleartext transmission of sensitive information in MAVLink protocol version 1.0 and 2.0

LGTM!

RVD#14: Insecure transport in SoftBank's Pepper and NAO robot's Qi Protocol

Triage Completed.

RVD#3317: MAVLink version handshaking allows for an attacker to bypass authentication

Aside from a PoC, and a possible mitigation this looks good to me as is.

RVD#3316: No authentication in MAVLink protocol

This has the potential to harm humans if a bad operator takes control of the device and it goes kamikaze. Please consider changing the Hazard value from H:U to H:H

RVD#3316: No authentication in MAVLink protocol

Fair enough. LGTM!

RVD#12: Authentication bypass vulnerability in SoftBank's Pepper and NAO robots's web console

Triage Completed.

RVD#9: Improper authorization mechanism in SoftBank's Pepper and NAO robots

Triage Complete.

RVD#68: Improper Access Control on IRB140's FlexPendant

Hello @Starsuki we should be able to triage this ticket this ticket in our lab. As @vmayoral said the main problem we have ATM is bandwidth, but always happy to...