CVE-2020-10284 RVD#3321: No Authentication required to exert manual control of the robot
Attackers can manually control uFactory robotic arms without authentication, potentially hijacking active sessions and overriding operator commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10284?
CVE-2020-10284 is a critical missing authorization vulnerability in uFactory xArm5 Lite, xArm 6 and xArm 7, published on 15 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets the user to add a password to the robot but as in xarm_studio 1.3.0 the option is missing from the menu. Assuming manual control, even by forcefully removing the current operator from an active session.
Weakness: CWE-656
Which versions are affected by CVE-2020-10284?
It affects 1 product.
Products include Ufactory Xarm Studio.
How do I fix CVE-2020-10284?
No fix has been published for CVE-2020-10284 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-10284 being exploited?
There is no known exploitation of CVE-2020-10284 in the wild and no public exploit code.
Sources
Also known as GHSA-2r34-57wf-fc67.