Vulnerability in Universal Robots Ur3, Ur5 And Ur10
CVE-2020-10267
Universal Robots control box CB 3.1 across firmware versions (tested on 1.12.1, 1.12, 1.11 and 1.10) does not encrypt or protect in any way the intellectual property artifacts installed from the UR+ platform of hardware and software components (URCaps). These files (*.urcaps) are stored under '/root/.urcaps' as plain zip files containing all the logic to add functionality to the UR3, UR5 and UR10 robots. This flaw allows attackers with access to the robot or the robot network (while in combination with other flaws) to retrieve and easily exfiltrate all installed intellectual property.
EPSS: 0.010 (59.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
Weakness classification (CWE)
References
- cve@aliasrobotics.com (x_refsource_CONFIRM, Exploit, Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2020-10267?
- CVE-2020-10267 is a high-severity vulnerability in Universal Robots Ur3, Ur5 And Ur10, classified under Missing Encryption of Sensitive Data. CVSS score: 7.5/10. Published 2020-04-06.
- How severe is CVE-2020-10267?
- High severity. CVSS v3 base score is 7.5 out of 10.