CVE-2020-10285

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The authentication implementation on the xArm controller has very low entropy, making it vulnerable to a brute-force attack. There is no mechanism in place to mitigate or lockout automated attempts to gain access.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307 CWE-331

Affected software

Vendor	Product	Versions
uFactory	xArm5 Lite, xArm 6 and xArm 7	v1.5.0 and before

References

https://github.com/aliasrobotics/RVD/issues/3322Issue Tracking, Third Party Advisory
https://github.com/aliasrobotics/RVD/issues/3322Issue Tracking, Third Party Advisory

Timeline

Published: Jul 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-102868.8the main user account has restricted privileges but is in the sudoers group and there is not any mechanism in place to prevent sudo su or su CVE-2020-102879.8The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers th CVE-2020-102889.8IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you CVE-2020-102898.8Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happ CVE-2020-10297.8An elevation of privilege vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, aka CVE-2020-102906.8Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide A CVE-2020-102917.5Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decisio CVE-2020-102928.2Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decisio CVE-2020-10307.8<p>An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file sys CVE-2020-10317.5<p>An information disclosure vulnerability exists in the way that the Windows Server DHCP service improperly discloses the contents of its m CVE-2020-10329.0A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authentica CVE-2020-10334.0<p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully