PT-2021-4026 · Kuka+1 · Kss+2

Chen Jie · Published 2021-07-28 · Updated 2022-06-08 · CVE-2021-33014

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions KUKA KR C4 control software versions prior to 8.7 Any product running KSS

Description The issue is related to the use of hard-coded credentials in the KUKA KR C4 control software and the KSS operating system. An attacker can exploit this to gain full access to the vulnerable system, specifically obtaining VxWorks Shell after login. This can be done remotely.

Recommendations For KUKA KR C4 control software versions prior to 8.7, update to version 8.7 or later to resolve the issue. For any product running KSS, consider changing the default credentials to custom, secure ones to minimize the risk of exploitation. As a temporary workaround, restrict access to the system to prevent unauthorized login attempts until a patch is applied.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2021-04553

CVE-2021-33014

Affected Products

Kss

Kuka Kr C4

Vxworks

References · 8

• https://osv.dev/vulnerability/CVE-2021-33014 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04553 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-33014 · Security Note
• https://ics-cert.us-cert.gov/advisories/icsa-21-208-01 · Note
• https://cisa.gov/uscert/ics/advisories/icsa-21-208-01 · Note
• https://t.me/cibsecurity/43414 · Telegram Post
• https://t.me/cvenotify/30786 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021072801 · Note