CVE-2020-10265 - CVE House
Back to Database
Status published Critical CVE-2020-10265

RVD#1443: UR dashboard server enables unauthenticated remote control of core robot functions

Vulnerability Description

Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards expose a service called DashBoard server at port 29999 that allows for control over core robot functions like starting/stopping programs, shutdown, reset safety and more. The DashBoard server is not protected by any kind of authentication or authorization.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-10265

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Bernhard Dieber, Benjamin Breiling (and many others)

References

More from Universal Robots

View All →
CVE-2020-10290
RVD#1495: Universal Robots URCaps execute with unbounded privileges
Medium 6.8
CVE-2020-10267
RVD#1489: Unprotected intelectual property in Universal Robots controller CB 3.1 across firmware versions
High 7.5
CVE-2020-10266
RVD#1487: No integrity checks on UR+ platform artifacts when installed in the robot
High 8.8
CVE-2018-10635
In Universal Robots Robot Controllers Version CB 3.1, SW Version...
Critical 9.8
CVE-2018-10633
Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100...
Critical 9.8

Affected Vendor

Universal Robots

View all reports →

Affected Software

Universal Robots Robot Controllers CB 2, CB3, e-series
Vulnerable Versions:
unspecified

Timeline

Official Publish: April 6th, 2020
Last Modified: September 17th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Weaknesses (CWE)

CWE-306

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1136 Create Account
Persistence
T1098 Account Manipulation
Privilege Escalation
T1021 Remote Services
Lateral Movement