CVE-2020-10286

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

the main user account has restricted privileges but is in the sudoers group and there is not any mechanism in place to prevent sudo su or sudo -i to be run gaining unrestricted access to sensible files, encryption, or issue orders that disrupt robot operation.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-656CWE-269

Affected software

VendorProductVersions
uFactoryxArm 5 Lite, xArm 6 and xArm 7v1.5.0 and before

References

Timeline

Published
Jul 15, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-102879.8The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers thCVE-2020-102889.8IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however youCVE-2020-102898.8Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happCVE-2020-10297.8An elevation of privilege vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, akaCVE-2020-102906.8Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide ACVE-2020-102917.5Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decisioCVE-2020-102928.2Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decisioCVE-2020-10307.8<p>An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file sysCVE-2020-10317.5<p>An information disclosure vulnerability exists in the way that the Windows Server DHCP service improperly discloses the contents of its mCVE-2020-10329.0A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticaCVE-2020-10334.0<p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfullyCVE-2020-10346.8<p>An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully
CVE-2020-10286: High severity, CVSS 8.8 | Vulnix