Vulnerability · Published Aug 21, 2020 · Assigned by Alias

CVE-2020-10290RVD#1495: Universal Robots URCaps execute with unbounded privileges

Medium 6.8

In plain English

A medium-severity security flaw in URx from Universal Robots. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.0)6.8Medium

Exploit odds (30 days)0.4%top 71.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents many primitives that can compromise the overall robot operations as demonstrated in our video. In our PoC we demonstrate how a malicious actor could 'cook' a custom URCap that when deployed by the user (intendedly or unintendedly) compromises the system

Affected products (as reported)

Vendor	Product	Versions
Universal Robots	URx	unspecified

Weakness: CWE-250 · Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/aliasrobotics/RVD/issues/1495 x_refsource_CONFIRM