RVD#1443: UR dashboard server ermöglicht unauthentifizierte Fernsteuerung von Kernroboterfunktionen

The lack of authentication on the DashBoard server presents a severe risk. An attacker could remotely control the robot, potentially causing physical damage, disrupting operations, or even creating safety hazards. Attack scenarios include unauthorized program execution, forced shutdowns, disabling safety mechanisms, and manipulating robot movements. The blast radius extends to any environment utilizing affected Universal Robots controllers, impacting manufacturing processes, research facilities, and potentially even collaborative robotics applications. This vulnerability's simplicity and the potential for physical harm make it particularly concerning.

Organizations utilizing Universal Robots controllers in automated manufacturing processes, research facilities, or any environment where robot control is critical are at risk. Specifically, deployments with direct internet exposure or lacking network segmentation are particularly vulnerable. Legacy installations running older, unpatched firmware versions are also at heightened risk.

1. 2020-04-06Disclosure

   disclosure

1. Reserviert2020-03-10
2. Veröffentlicht2020-04-06
3. Geändert2024-09-17
4. EPSS aktualisiert2026-04-02

The primary mitigation is to upgrade to a patched version of the Universal Robots Robot Controller software. Universal Robots has likely released updates addressing this vulnerability; consult their official advisory for specific version numbers. As an immediate workaround, consider isolating affected controllers from external networks to prevent unauthorized access. Implementing a firewall rule to block inbound connections to port 29999 can also reduce the attack surface. While not a complete solution, these steps can limit the potential for exploitation until a patch can be applied. After upgrade, confirm functionality by attempting to access the DashBoard server with and without valid credentials.