PT-2020-12040 · Visual Components · Visual Components

Sharon Brizinov · Published 2020-11-06 · Updated 2021-12-20 · CVE-2020-10291

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Visual Components (affected versions not specified)

Description The Visual Components software, a robotic simulator, has a vulnerability in its network license server. The server binds to all interfaces and listens for packets over UDP port 5093 without requiring authentication or authorization. This allows attackers to retrieve sensitive system information, including detailed hardware and OS characteristics, by exploiting the RMS Sentinel license manager service. The protocol used leaks information about the receiving server, license information, and managing licenses. Attackers can use this flaw to launch local simulations with similar characteristics, potentially leading to further attacks. Additionally, the PLC Connectivity feature in Visual Components enables attackers to pivot from the simulator to robots or other Industrial Control System (ICS) devices, such as PLCs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Information Disclosure

Weakness Enumeration

CWE-306

CWE-200

Related Identifiers

CVE-2020-10291

Affected Products

Visual Components

References · 5

• https://osv.dev/vulnerability/CVE-2020-10291 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10291 · Security Note
• https://github.com/aliasrobotics/RVD/issues/3336 · Note
• https://t.me/cibsecurity/15965 · Telegram Post
• https://t.me/cvenotify/5237 · Telegram Post