CVE-2020-10284

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets the user to add a password to the robot but as in xarm_studio 1.3.0 the option is missing from the menu. Assuming manual control, even by forcefully removing the current operator from an active session.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-656

Affected software

Vendor	Product	Versions
uFactory	xArm5 Lite, xArm 6 and xArm 7	v1.5.0 and before

References

https://www.ufactory.cc/#/en/support/download/xarmVendor Advisory
https://www.ufactory.cc/#/en/support/download/xarmVendor Advisory

Timeline

Published: Jul 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-102859.8The authentication implementation on the xArm controller has very low entropy, making it vulnerable to a brute-force attack. There is no mec CVE-2020-102868.8the main user account has restricted privileges but is in the sudoers group and there is not any mechanism in place to prevent sudo su or su CVE-2020-102879.8The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers th CVE-2020-102889.8IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you CVE-2020-102898.8Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happ CVE-2020-10297.8An elevation of privilege vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, aka CVE-2020-102906.8Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide A CVE-2020-102917.5Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decisio CVE-2020-102928.2Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decisio CVE-2020-10307.8<p>An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file sys CVE-2020-10317.5<p>An information disclosure vulnerability exists in the way that the Windows Server DHCP service improperly discloses the contents of its m CVE-2020-10329.0A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authentica