Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2020-10265— RVD#1443: UR dashboard server enables unauthenticated remote control of core robot functions

Quick assessment

Affected
Universal Robots Universal Robots Robot Controllers CB 2, CB3, e-series
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

多款Universal Robots产品中存在访问控制错误漏洞。攻击者可利用该漏洞控制核心的机器人功能（例如，启动/停止程序等功能）。以下产品及版本受到影响：Universal Robots UR 10（3.0.14989版本至3.3.3.292版本，1.4及之前版本）；Universal Robots UR 3（3.0.14989版本至3.3.3.292版本）；Universal Robots UR 5（3.0.14989版本至3.3.3.292版本，1.4及之前版本）；Universal Robots

AI Predicted 8.0 Difficulty: Easy EPSS 1.47% · P73
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-10265

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RVD#1443: UR dashboard server enables unauthenticated remote control of core robot functions
Source: CVE Program / CVE List V5
Vulnerability Description
Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards expose a service called DashBoard server at port 29999 that allows for control over core robot functions like starting/stopping programs, shutdown, reset safety and more. The DashBoard server is not protected by any kind of authentication or authorization.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
多款Universal Robots产品访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
多款Universal Robots产品中存在访问控制错误漏洞。攻击者可利用该漏洞控制核心的机器人功能（例如，启动/停止程序等功能）。以下产品及版本受到影响：Universal Robots UR 10（3.0.14989版本至3.3.3.292版本，1.4及之前版本）；Universal Robots UR 3（3.0.14989版本至3.3.3.292版本）；Universal Robots UR 5（3.0.14989版本至3.3.3.292版本，1.4及之前版本）；Universal Robots
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Universal Robots Universal Robots Robot Controllers CB 2, CB3, e-series unspecified -

II. Public POCs for CVE-2020-10265

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-10265

请登录查看更多情报信息。

Other References for CVE-2020-10265 (1)

Same Patch Batch · Universal Robots · 2020-04-06 · 3 CVEs total

CVE-2020-10266 RVD#1487: No integrity checks on UR+ platform artifacts when installed in the robot
CVE-2020-10267 RVD#1489: Unprotected intelectual property in Universal Robots controller CB 3.1 across fi

IV. Related Vulnerabilities

Same vendor: Universal Robots
Same weakness: CWE-306

V. Comments for CVE-2020-10265

No comments yet

Leave a comment