Design/Logic Flaw

Universal Robots control box CB 3.1 across firmware versions tested on 1.12.1, 1.12, 1.11 and 1.10 does not encrypt or protect in any way the intellectual property artifacts installed from the UR+ platform of hardware and software components URCaps. These files .urcaps are stored under...

Design/Logic Flaw

UR+ Universal Robots+ is a platform of hardware and software component sellers, for Universal Robots robots. When installing any of these components in the robots e.g. in the UR10, no integrity checks are performed. Moreover, the SDK for making such components can be easily obtained from Universa...

Authorization

Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards expose a service called DashBoard server at port 29999 that allows for control over core robot functions like starting/stopping programs, shutdown, reset safe...

CVE-2020-10266 RVD#1487: No integrity checks on UR+ platform artifacts when installed in the robot

UR+ Universal Robots+ is a platform of hardware and software component sellers, for Universal Robots robots. When installing any of these components in the robots e.g. in the UR10, no integrity checks are performed. Moreover, the SDK for making such components can be easily obtained from Universa...

CVE-2020-10265 RVD#1443: UR dashboard server enables unauthenticated remote control of core robot functions

Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards expose a service called DashBoard server at port 29999 that allows for control over core robot functions like starting/stopping programs, shutdown, reset safe...

CVE-2020-10267

CVE-2020-10267 affects the Universal Robots control box CB 3.1 (firmware versions 1.12.1, 1.12, 1.11, 1.10) where UR+ URCaps artifacts are stored under /root/.urcaps as plain zip files containing logic for UR3/UR5/UR10. The underlying issue is that these intellectual property artifacts are not en...

CVE-2020-10266

CVE-2020-10266 affects UR+ (Universal Robots+) components used with Universal Robots robotic arms (e.g., UR10). The vulnerability arises because installing components from UR+ involves no integrity checks, and the SDK to create such components is publicly available. An attacker could craft a mali...

CVE-2020-10267 RVD#1489: Unprotected intelectual property in Universal Robots controller CB 3.1 across firmware versions

Universal Robots control box CB 3.1 across firmware versions tested on 1.12.1, 1.12, 1.11 and 1.10 does not encrypt or protect in any way the intellectual property artifacts installed from the UR+ platform of hardware and software components URCaps. These files .urcaps are stored under...

CVE-2020-10265

The CVE-2020-10265 entry covers UR Universal Robots Robot Controllers (CB2 1.4+, CB3 3.0+, e-series 5.0+) exposing a DashBoard server on port 29999 that allows control over core robot functions (start/stop programs, shutdown, reset safety, etc.) without authentication/authorization. This unauthen...

PT-2020-12014 · Universal Robots · Universal Robots Robot Controllers

Name of the Vulnerable Software and Affected Versions: Universal Robots Robot Controllers versions 1.4 and upwards Universal Robots Robot Controllers CB3 SW Version 3.0 and upwards Universal Robots Robot Controllers e-series SW Version 5.0 and upwards Description: The issue concerns the exposure ...

Friday Squid Blogging: Researchers Investigating Using Squid Propulsion for Underwater Robots

Interesting article and paper. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

News Wrap: Hotel Robot Hacks, FTC Stalkerware Crackdown

Threatpost editors break down the top news stories for the week ended Oct. 25. The biggest stories include: An unsecured NFC tag opening a door to trivial exploitation of robots that are used inside Japanese hotels. The FTC has banned the sale of three apps – marketed to monitor children and...

Tachyon - Fast HTTP Dead File Finder

Tachyon is a fast web application security reconnaissance tool. It is specifically meant to crawl web application and look for left over or non-indexed files with the addition of reporting pages or scripts leaking internal data. User Requirements Linux Python 3.5.2 User Installation Install: $...

CVE-2015-9400

The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection...

Sql injection

The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection...

Meet Aztarna, a tool to find vulnerable Internet connected robots

By Waqas The company behind Aztarna is Alias Robotics, a cyber-security startup. Manufacturers and users of IoT robots should breathe a sigh of relief that the cyber-security startup Alias Robotics has developed a robot scanning tool that can track any robot connected to the internet and powered ...

Researchers Release Tool That Finds Vulnerable Robots on the Internet

A team at a robot cybersecurity startup has released a free, open-source tool for information security professionals to help them easily 'footprint' and detect unprotected robots, not only connected to the Internet, but also to the industrial environments where they operate. Dubbed "Aztarna ," th...

Researchers Release Tool That Finds Vulnerable Robots on the Internet

A team at a robot cybersecurity startup has released a free, open-source tool for information security professionals to help them easily 'footprint' and detect unprotected robots, not only connected to the Internet, but also to the industrial environments where they operate. Dubbed "Aztarna," the...

This Week in Security News: Ransomware and Cyber Threats

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about new routines for encryption of JobCrypter ransomware. Also, understand how Emotet has managed to evolve into one of the most...

Debunking AI’s Impact on the Cybersecurity Skills Gap

Artificial intelligence is the latest buzzword to take hold of the cybersecurity industry. It is being touted, among other things, as the ultimate solution to the cybersecurity skills gap. But just how accurate is this belief? Will AI be the cure to all of our cybersecurity ailments, as human...