https://vulnogram.org/ Most recent CVEs assigned by Alias Robotics S.L. (alias). https://vulnogram.org/seaview/icons/alias.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:08 GMT https://vulnogram.org/CVE-2020-10291 https://vulnogram.org/CVE-2020-10291 Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from a network… High Network Exploitable Fri, 06 Nov 2020 11:20:19 GMT https://vulnogram.org/CVE-2020-10292 https://vulnogram.org/CVE-2020-10292 Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from a network… High Network Exploitable Fri, 06 Nov 2020 11:20:12 GMT https://vulnogram.org/CVE-2020-10290 https://vulnogram.org/CVE-2020-10290 Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents many primitives that can compromise the overall robot operations as demonstrated in our video… Medium Fri, 21 Aug 2020 15:05:19 GMT https://vulnogram.org/CVE-2020-10283 https://vulnogram.org/CVE-2020-10283 The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation, in order to maintain backwards compatibility, GCS and autopilot negotiate the version via the AUTOPILOT_VERSIO… High Network Exploitable Thu, 20 Aug 2020 08:15:13 GMT https://vulnogram.org/CVE-2020-10289 https://vulnogram.org/CVE-2020-10289 Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through… High Thu, 20 Aug 2020 08:05:14 GMT https://vulnogram.org/CVE-2020-10287 https://vulnogram.org/CVE-2020-10287 The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documented functionality that helps customer set up however, out of our research, we found multiple… Critical Network Exploitable Wed, 15 Jul 2020 22:15:17 GMT https://vulnogram.org/CVE-2020-10288 https://vulnogram.org/CVE-2020-10288 IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you can input whatever you like. As long as the field isn't empty it will be accepted. Critical Network Exploitable Wed, 15 Jul 2020 22:15:13 GMT https://vulnogram.org/CVE-2020-10286 https://vulnogram.org/CVE-2020-10286 the main user account has restricted privileges but is in the sudoers group and there is not any mechanism in place to prevent sudo su or sudo -i to be run gaining unrestricted access to sensible files, encryption, or issue orders that disrupt robot… Critical Network Exploitable Wed, 15 Jul 2020 21:15:13 GMT https://vulnogram.org/CVE-2020-10285 https://vulnogram.org/CVE-2020-10285 The authentication implementation on the xArm controller has very low entropy, making it vulnerable to a brute-force attack. There is no mechanism in place to mitigate or lockout automated attempts to gain access. Critical Network Exploitable Wed, 15 Jul 2020 21:00:14 GMT https://vulnogram.org/CVE-2020-10284 https://vulnogram.org/CVE-2020-10284 No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets the user to add a password to the robot but as in xarm_studio 1.3.0 the option is missing from the menu. Assuming… Critical Network Exploitable Wed, 15 Jul 2020 19:25:13 GMT https://vulnogram.org/CVE-2020-10282 https://vulnogram.org/CVE-2020-10282 The Micro Air Vehicle Link (MAVLink) protocol presents no authentication mechanism on its version 1.0 (nor authorization) whichs leads to a variety of attacks including identity spoofing, unauthorized access, PITM attacks and more. According to liter… Critical Network Exploitable Fri, 03 Jul 2020 14:30:15 GMT https://vulnogram.org/CVE-2020-10281 https://vulnogram.org/CVE-2020-10281 This vulnerability applies to the Micro Air Vehicle Link (MAVLink) protocol and allows a remote attacker to gain access to sensitive information provided it has access to the communication medium. MAVLink is a header-based protocol that does not perf… High Network Exploitable Fri, 03 Jul 2020 14:30:11 GMT https://vulnogram.org/CVE-2020-10279 https://vulnogram.org/CVE-2020-10279 MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents insecure defaults for robots. These insecurities include a way for users to escalate their acce… Critical Network Exploitable Wed, 24 Jun 2020 06:05:23 GMT https://vulnogram.org/CVE-2020-10280 https://vulnogram.org/CVE-2020-10280 The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard. High Network Exploitable Wed, 24 Jun 2020 05:45:13 GMT https://vulnogram.org/CVE-2020-10269 https://vulnogram.org/CVE-2020-10269 One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in WiFi Master (Access Point) mode. Credentials to such wireless Access Point default to well known and widely s… Critical Network Exploitable Wed, 24 Jun 2020 05:05:16 GMT https://vulnogram.org/CVE-2020-10275 https://vulnogram.org/CVE-2020-10275 The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthor… Critical Network Exploitable Wed, 24 Jun 2020 05:00:26 GMT https://vulnogram.org/CVE-2020-10273 https://vulnogram.org/CVE-2020-10273 MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual property artifacts installed in the robots. This flaw allows attackers with access to the robot or the robot network (while in combinati… High Network Exploitable Wed, 24 Jun 2020 04:55:29 GMT https://vulnogram.org/CVE-2020-10278 https://vulnogram.org/CVE-2020-10278 The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order. This can be leveraged by a Malicious operator to boot from a Live Image. Medium Wed, 24 Jun 2020 04:55:22 GMT https://vulnogram.org/CVE-2020-10277 https://vulnogram.org/CVE-2020-10277 There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine. Medium Wed, 24 Jun 2020 04:55:17 GMT https://vulnogram.org/CVE-2020-10270 https://vulnogram.org/CVE-2020-10270 Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcoded IP address. Credentials to such wireless interface default to well known and widely spr… Critical Network Exploitable Wed, 24 Jun 2020 04:50:18 GMT https://vulnogram.org/CVE-2020-10276 https://vulnogram.org/CVE-2020-10276 The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigat… Critical Network Exploitable Wed, 24 Jun 2020 04:50:14 GMT https://vulnogram.org/CVE-2020-10271 https://vulnogram.org/CVE-2020-10271 MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph to all network interfaces, wireless and wired. This is the result of a bad set up and can be mitigated by appropriately configu… Critical Network Exploitable Wed, 24 Jun 2020 04:40:18 GMT https://vulnogram.org/CVE-2020-10274 https://vulnogram.org/CVE-2020-10274 The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273… High Wed, 24 Jun 2020 04:40:12 GMT https://vulnogram.org/CVE-2020-10272 https://vulnogram.org/CVE-2020-10272 MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take contr… Critical Network Exploitable Wed, 24 Jun 2020 04:35:12 GMT https://vulnogram.org/CVE-2020-10268 https://vulnogram.org/CVE-2020-10268 Critical services for operation can be terminated from windows task manager, bringing the manipulator to a halt. After this a Re-Calibration of the brakes needs to be performed. Be noted that this only can be accomplished either by a Kuka technician… Tue, 16 Jun 2020 17:55:11 GMT https://vulnogram.org/CVE-2020-10267 https://vulnogram.org/CVE-2020-10267 Universal Robots control box CB 3.1 across firmware versions (tested on 1.12.1, 1.12, 1.11 and 1.10) does not encrypt or protect in any way the intellectual property artifacts installed from the UR+ platform of hardware and software components (URCap… High Network Exploitable Mon, 06 Apr 2020 12:08:40 GMT https://vulnogram.org/CVE-2020-10266 https://vulnogram.org/CVE-2020-10266 UR+ (Universal Robots+) is a platform of hardware and software component sellers, for Universal Robots robots. When installing any of these components in the robots (e.g. in the UR10), no integrity checks are performed. Moreover, the SDK for making s… High Network Exploitable Mon, 06 Apr 2020 12:08:40 GMT https://vulnogram.org/CVE-2020-10265 https://vulnogram.org/CVE-2020-10265 Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards expose a service called DashBoard server at port 29999 that allows for control over core robot functions like s… Critical Network Exploitable Mon, 06 Apr 2020 12:08:40 GMT https://vulnogram.org/CVE-2020-10264 https://vulnogram.org/CVE-2020-10264 CB3 SW Version 3.3 and upwards, e-series SW Version 5.0 and upwards allow authenticated access to the RTDE (Real-Time Data Exchange) interface on port 30004 which allows setting registers, the speed slider fraction as well as digital and analog Outpu… High Mon, 06 Apr 2020 12:08:40 GMT