CVE-2020-10267 affects Universal Robots CB 3.1 control boxes across various firmware versions (1.10-1.12.1), specifically the UR3, UR5, and UR10 robot models. The vulnerability stems from the lack of encryption or protection for UR+ platform intellectual property artifacts (URCaps) stored as plain ZIP files. This allows unauthorized access and exfiltration of proprietary robot logic. With a CVSS score of 7.5 (HIGH), this vulnerability has a network attack vector and low attack complexity, potentially leading to high confidentiality impact without affecting integrity or availability. While it requires an attacker to have network access to the robot, it could be combined with other flaws for exploitation. Currently, there is no evidence of active exploitation, nor are there any public exploit modules available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating low public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.0.14989, <= 3.1.18213CPE matchmatch criteria | cpe:2.3:a:universal-robots:ur_software:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.