CVE-2018-10633

Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset passwords for the controller.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/104710	Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-191-01	Mitigation Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/104710	Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-191-01	Mitigation Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:universal-robots:cb3.1_firmware:3.4.5-100:*:*:*:*:*:*:*

cpe:2.3:h:universal-robots:cb3.1:-:*:*:*:*:*:*:*

History

21 Nov 2024, 03:41

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/bid/104710 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/104710 - Third Party Advisory, VDB Entry
References	~~() https://ics-cert.us-cert.gov/advisories/ICSA-18-191-01 - Mitigation, Third Party Advisory, US Government Resource~~	() https://ics-cert.us-cert.gov/advisories/ICSA-18-191-01 - Mitigation, Third Party Advisory, US Government Resource

Information

Published : 2018-07-11 17:29

Updated : 2024-11-21 03:41

NVD link : CVE-2018-10633

Mitre link : CVE-2018-10633

CVE.ORG link : CVE-2018-10633

JSON object : View

Products Affected

universal-robots

cb3.1_firmware
cb3.1

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2018-10633", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-07-11T17:29:00.287", "references": [{"url": "http://www.securityfocus.com/bid/104710", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-191-01", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.securityfocus.com/bid/104710", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-191-01", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-798"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset passwords for the controller."}, {"lang": "es", "value": "Universal Robots Robot Controllers en versi\u00f3n CB 3.1, software en versi\u00f3n 3.4.5-100, utiliza credenciales embebidas que podr\u00edan permitir que un atacante reinicie contrase\u00f1as para el controlador."}], "lastModified": "2024-11-21T03:41:42.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:universal-robots:cb3.1_firmware:3.4.5-100:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7DBF23CE-E61B-4EDF-80D5-261F901CA957"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:universal-robots:cb3.1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6646769C-25A1-4558-A229-62AF8B1FE167"}], "operator": "OR"}], "operator": "AND"}], "vendorComments": [{"comment": "Starting with software version 5.10 (e-series), it is possible to set system administrator credentials. Universal Robots recommends that all users change the default password and securely document the password.\n\nCB2 and CB3 cobots are designed to be operating in factory networks where security relies on boundary protection (firewalls) and trusted clients on the network. They must only be connected to trusted networks and operated by authorized personnel.\n", "lastModified": "2022-04-12T13:41:59.347", "organization": "Universal Robots"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}