CVE-2020-10265CWE-306

RVD#1443: UR dashboard server enables unauthenticated remote control of core robot functions

Critical · published April 6, 2020

CVSS v3.0
9.4
EPSS
1%
Percentile
73.5
In the wild
Unconfirmed
What it is

🚨 A robot controller with a port wide open at 29999 means anyone can commandeer your robots! 🔥 Think of the DashBoard server as a bank vault with the door wide open—no guards, no alarms, just a tempting treasure for anyone to stroll inside. It's an opportunity for unauthorized access to core functions, like a thief taking over bank operations without a single check. 🤖💰 An attacker could easily start or stop robot programs, shut them down, or even reset safety protocols, leading to potentially dangerous situations. Imagine a rogue operator sending your robots on a wild rampage or shutting them down entirely at critical moments! This is absolutely devastating for both operational integrity and safety! ⚡

Put simply

Think of the DashBoard server as a bank vault with the door wide open—no guards, no alarms, just a tempting treasure for anyone to stroll inside. It's an opportunity for unauthorized access to core functions, like a thief taking over bank operations without a single check. 🤖💰 This vulnerability arises from the DashBoard server lacking any authentication or authorization checks, meaning that anyone with network access can control robot operations without restrictions. Versions CB2 SW 1.4 and up, CB3 SW 3.0 and up, and E-series SW 5.0 and up are all affected.

What to do

An attacker could easily start or stop robot programs, shut them down, or even reset safety protocols, leading to potentially dangerous situations. Imagine a rogue operator sending your robots on a wild rampage or shutting them down entirely at critical moments! This is absolutely devastating for both operational integrity and safety! ⚡ To remediate this critical vulnerability, ensure that the DashBoard server is not exposed to the public internet and restrict access to trusted networks only. Additionally, consider implementing authentication measures and upgrading to the latest software version available. 🛡️ You've got this! Follow these steps to secure those robot controllers, and you'll be a security hero in no time! 🚀

The record
Technical detail
CVSS v3.0
9.4 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01466 · 73.5th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2020-04-06T12:08Z
EPSS history
Timeline
  • 06 APR 12:08Z
    RVD#1443: UR dashboard server enables unauthenticated remote control of core robot functions
    cvelistv5