CVE-2020-10285 RVD#3322: Weak authentication implementation make the system vulnerable to a brute-force attack over adjacent networks
Weak authentication entropy in xArm controllers allows brute-force attacks over adjacent networks, potentially leading to unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10285?
CVE-2020-10285 is a critical vulnerability in uFactory xArm5 Lite, xArm 6 and xArm 7, published on 15 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The authentication implementation on the xArm controller has very low entropy, making it vulnerable to a brute-force attack. There is no mechanism in place to mitigate or lockout automated attempts to gain access.
Which versions are affected by CVE-2020-10285?
It affects 1 product.
Products include Ufactory Xarm 5 Lite Firmware.
How do I fix CVE-2020-10285?
No fix has been published for CVE-2020-10285 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-10285 being exploited?
There is no known exploitation of CVE-2020-10285 in the wild and no public exploit code.
Other vulnerabilities in uFactory xArm5 Lite, xArm 6 and xArm 7
Sources
Also known as GHSA-jfc5-j6cj-cj2x.