CVE-2020-10267 RVD#1489: Unprotected intelectual property in Universal Robots controller CB 3.1 across firmware versions
Attackers with network or physical access can retrieve unencrypted intellectual property files from Universal Robots controllers, exposing proprietary logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10267?
CVE-2020-10267 is a high-severity vulnerability in Universal Robots UR3, UR5 and UR10, published on 6 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Universal Robots control box CB 3.1 across firmware versions (tested on 1.12.1, 1.12, 1.11 and 1.10) does not encrypt or protect in any way the intellectual property artifacts installed from the UR+ platform of hardware and software components (URCaps). These files (*.urcaps) are stored under '/root/.urcaps' as plain zip files containing all the logic to add functionality to the UR3, UR5 and UR10 robots. This flaw allows attackers with access to the robot or the robot network (while in combination with other flaws) to retrieve and easily exfiltrate all installed intellectual property.
Which versions are affected by CVE-2020-10267?
It affects 1 product.
Products include Universal-Robots Ur Software.
How do I fix CVE-2020-10267?
No fix has been published for CVE-2020-10267 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-10267 being exploited?
There is no known exploitation of CVE-2020-10267 in the wild and no public exploit code.
Other vulnerabilities in Universal Robots UR3, UR5 and UR10
Sources
Also known as GHSA-m3fh-cx4w-xf4m.