PT-2020-12014 · Universal Robots · Universal Robots Robot Controllers

Published 2020-04-06 · Updated 2025-07-08 · CVE-2020-10265

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Universal Robots Robot Controllers versions 1.4 and upwards Universal Robots Robot Controllers CB3 SW Version 3.0 and upwards Universal Robots Robot Controllers e-series SW Version 5.0 and upwards

Description The issue concerns the exposure of a service called DashBoard server at port 29999, which allows control over core robot functions such as starting/stopping programs, shutdown, reset safety, and more. This DashBoard server lacks any kind of authentication or authorization, posing a significant risk.

Recommendations For Universal Robots Robot Controllers versions 1.4 and upwards, consider restricting access to the DashBoard server at port 29999 until a proper authentication or authorization mechanism is implemented. For Universal Robots Robot Controllers CB3 SW Version 3.0 and upwards, restrict access to the DashBoard server at port 29999 to minimize the risk of exploitation. For Universal Robots Robot Controllers e-series SW Version 5.0 and upwards, disable the DashBoard server at port 29999 if possible, or limit its accessibility to trusted networks or devices.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-10265

Affected Products

Universal Robots Robot Controllers

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-10265 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10265 · Vendor Advisory
• https://universal-robots.com/how-tos-and-faqs/how-to/ur-how-tos/real-time-data-exchange-rtde-guide · Vendor Advisory
• https://twitter.com/AliasRobotics/status/1942516014228594749 · Twitter Post
• https://t.me/cvenotify/2420 · Telegram Post