CVE-2020-10290mediumCWE-250

CVE-2020-10290: falha de média gravidade em Universal Robots URx

RVD#1495: Universal Robots URCaps execute with unbounded privileges

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar URx

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 0.4%
Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents many primitives that can compromise the overall robot operations as demonstrated in our video. In our PoC we demonstrate how a malicious actor could 'cook' a custom URCap that when deployed by the user (intendedly or unintendedly) compromises the system
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Universal Robots · URx
CVEs relacionadas — Universal Robots URx

No mesmo produto, das mais perigosas para as menos.

CVE-2020-10266HIGHRVD#1487: No integrity checks on UR+ platform artifacts when installed in the robotEPSS 0.5%