CVE-2020-10264 : CB3 SW Version 3.3 and upwards, e-series SW Version 5.0 and upwards allow authen

CB3 SW Version 3.3 and upwards, e-series SW Version 5.0 and upwards allow authenticated access to the RTDE (Real-Time Data Exchange) interface on port 30004 which allows setting registers, the speed slider fraction as well as digital and analog Outputs. Additionally unautheticated reading of robot data is also possible

Published 2020-04-06 12:15:13

Updated 2021-09-14 13:37:46

Source Alias Robotics S.L.

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2020-10264

Universal-robots » Ur Software
Versions from including (>=) 3.0.14989 and up to, including, (<=) 3.3.3.292
cpe:2.3:a:universal-robots:ur_software:*:*:*:*:*:*:*:*
Matching versions
When used together with: Universal-robots » Ur10 » Version: N/A
When used together with: Universal-robots » UR3 » Version: N/A
When used together with: Universal-robots » UR5 » Version: N/A
Universal-robots » Ur Software
Versions from including (>=) 5.0
cpe:2.3:a:universal-robots:ur_software:*:*:*:*:*:*:*:*
Matching versions
When used together with: Universal-robots » Ur10e » Version: N/A
When used together with: Universal-robots » Ur3e » Version: N/A
When used together with: Universal-robots » Ur5e » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-10264

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 29 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-10264

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.8	MEDIUM	AV:A/AC:L/Au:N/C:P/I:P/A:P	6.5	6.4	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.8	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	Alias Robotics S.L.
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.8	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-10264

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: cve@aliasrobotics.com (Secondary)
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Assigned by: nvd@nist.gov (Primary)

Vendor statements for CVE-2020-10264

Universal Robots 2022-04-12

Software version 5.10 brings improvements to usability and configurability of Secure Shell Protocol (SSH), such that tunneling can be used to secure primary, secondary, RT, RTDE, DashBoard server and other interfaces. Universal Robots recommends that all users use SSH tunneling to access these interfaces in applications requiring authentication and encryption. Additionally, SW version 5.10 includes a built-in configurable firewall, allowing fine-grained restrictions of remote access, and number of other security improvements. Universal Robots (UR) recommends always using the latest UR software, as security improvements will be rolled out continuously. CB2 and CB3 cobots are designed to be operating in factory networks where security relies on boundary protection (firewalls) and trusted clients on the network. They must only be connected to trusted networks and operated by authorized personnel.

References for CVE-2020-10264

https://www.universal-robots.com/how-tos-and-faqs/how-to/ur-how-tos/real-time-data-exchange-rtde-guide/

Real-Time Data Exchange (RTDE) Guide - 22229
Vendor Advisory

CVEs referencing this url