CVE-2020-10268

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Critical services for operation can be terminated from windows task manager, bringing the manipulator to a halt. After this a Re-Calibration of the brakes needs to be performed. Be noted that this only can be accomplished either by a Kuka technician or by Kuka issued calibration hardware that interfaces with the manipulator furthering the delay and increasing operational costs.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-749

Affected software

Vendor	Product	Versions
KUKA Roboter GmbH	KR3R540, KRC4, KSS8.5.7HF1, Win7_Embedded	unspecified

References

https://github.com/aliasrobotics/RVD/issues/2550Third Party Advisory
https://github.com/aliasrobotics/RVD/issues/2550Third Party Advisory

Timeline

Published: Jun 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-102699.8One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in CVE-2020-10277.8An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation o CVE-2020-102709.8Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Da CVE-2020-102719.8MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph to all network in CVE-2020-102729.8MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort CVE-2020-102737.5MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual property artifacts install CVE-2020-102747.1The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from th CVE-2020-102759.8The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERN CVE-2020-102769.8The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to CVE-2020-102776.4There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such a CVE-2020-102784.6The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order. Thi CVE-2020-102799.8MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating s