CVE-2020-10290

{"containers": {"cna": {"affected": [{"product": "URx", "vendor": "Universal Robots", "versions": [{"status": "affected", "version": "unspecified"}]}], "credits": [{"lang": "en", "value": "Victor Mayoral Vilches and Unai Ayucar Carbajo (Alias Robotics)"}], "datePublic": "2020-08-21T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents many primitives that can compromise the overall robot operations as demonstrated in our video. In our PoC we demonstrate how a malicious actor could 'cook' a custom URCap that when deployed by the user (intendedly or unintendedly) compromises the system"}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-250", "description": "CWE-250 (Execution with Unnecessary Privileges)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-08-21T15:05:19.000Z", "orgId": "dc524f69-879d-41dc-ab8f-724e78658a1a", "shortName": "Alias"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/aliasrobotics/RVD/issues/1495"}], "source": {"defect": ["RVD#1495"], "discovery": "EXTERNAL"}, "title": "RVD#1495: Universal Robots URCaps execute with unbounded privileges", "x_generator": {"engine": "Robot Vulnerability Database (RVD)"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@aliasrobotics.com", "DATE_PUBLIC": "2020-08-21T15:02:38 +00:00", "ID": "CVE-2020-10290", "STATE": "PUBLIC", "TITLE": "RVD#1495: Universal Robots URCaps execute with unbounded privileges"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "URx", "version": {"version_data": [{"version_value": ""}]}}]}, "vendor_name": "Universal Robots"}]}}, "credit": [{"lang": "eng", "value": "Victor Mayoral Vilches and Unai Ayucar Carbajo (Alias Robotics)"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents many primitives that can compromise the overall robot operations as demonstrated in our video. In our PoC we demonstrate how a malicious actor could 'cook' a custom URCap that when deployed by the user (intendedly or unintendedly) compromises the system"}]}, "generator": {"engine": "Robot Vulnerability Database (RVD)"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "medium", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-250 (Execution with Unnecessary Privileges)"}]}]}, "references": {"reference_data": [{"name": "https://github.com/aliasrobotics/RVD/issues/1495", "refsource": "CONFIRM", "url": "https://github.com/aliasrobotics/RVD/issues/1495"}]}, "source": {"defect": ["RVD#1495"], "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T10:58:40.357Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/aliasrobotics/RVD/issues/1495"}]}]}, "cveMetadata": {"assignerOrgId": "dc524f69-879d-41dc-ab8f-724e78658a1a", "assignerShortName": "Alias", "cveId": "CVE-2020-10290", "datePublished": "2020-08-21T15:05:19.977Z", "dateReserved": "2020-03-10T00:00:00.000Z", "dateUpdated": "2024-09-16T19:15:10.454Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "URx", "vendor": "Universal Robots", "versions": [{"status": "affected", "version": "unspecified"}]}], "source": "cve@aliasrobotics.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sintef:urx:-:*:*:*:*:*:*:*", "matchCriteriaId": "D90D07FA-3643-4EBD-A0B3-7A5915E5216B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents many primitives that can compromise the overall robot operations as demonstrated in our video. In our PoC we demonstrate how a malicious actor could 'cook' a custom URCap that when deployed by the user (intendedly or unintendedly) compromises the system"}, {"lang": "es", "value": "El controlador Universal Robots ejecuta URCaps (archivos zip que contienen aplicaciones con tecnolog\u00eda Java) sin restricciones de permiso y una API amplia que presenta muchas primitivas que pueden comprometer las operaciones generales del robot, como es demostrado en nuestro video. En nuestra PoC demostramos c\u00f3mo un actor malicioso podr\u00eda \"cook\" un URCap personalizado que cuando se implementaba por el usuario (intencional o involuntariamente) compromete el sistema."}], "id": "CVE-2020-10290", "lastModified": "2026-06-17T02:47:38.320", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "cve@aliasrobotics.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-08-21T15:15:12.540", "references": [{"source": "cve@aliasrobotics.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://github.com/aliasrobotics/RVD/issues/1495"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://github.com/aliasrobotics/RVD/issues/1495"}], "sourceIdentifier": "cve@aliasrobotics.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-250"}], "source": "cve@aliasrobotics.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}