PT-2020-12033 · Ufactory · Xarm Studio

Alfonso Glera · Published 2020-07-15 · Updated 2020-07-23 · CVE-2020-10284

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions xarm studio version 1.3.0

Description The issue allows for control of the robot inside the network without requiring authentication. According to the user manual, there should be an option to add a password to the robot, but this option is missing from the menu in xarm studio 1.3.0. This allows for manual control, including forcefully removing the current operator from an active session.

Recommendations For xarm studio version 1.3.0, consider adding a password to the robot manually or through alternative means to restrict unauthorized access, and ensure that only authorized operators have control over the robot. As a temporary workaround, restrict access to the robot's control interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-656

Related Identifiers

CVE-2020-10284

Affected Products

Xarm Studio

References · 4

• https://ufactory.cc/#/en/support/download/xarm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10284 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10284 · Vendor Advisory
• https://t.me/cvenotify/5066 · Telegram Post