RVD#1443: UR dashboard server enables unauthenticated remote control of core robot functions
CVE-2020-10265

9.4CRITICAL

Key Information:

Vendor

Universal Robots

Status
Universal Robots Robot Controllers Cb 2, Cb3, E-series
Vendor
CVE Published:
6 April 2020

What is CVE-2020-10265?

Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards expose a service called DashBoard server at port 29999 that allows for control over core robot functions like starting/stopping programs, shutdown, reset safety and more. The DashBoard server is not protected by any kind of authentication or authorization.

Affected Version(s)

Universal Robots Robot Controllers CB 2, CB3, e-series = unspecified

References

https://www.universal-robots.com/how-tos-and-faqs/how-to/...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.4
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
9.4
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bernhard Dieber, Benjamin Breiling (and many others)
.