CVE-2018-10633
📋 TL;DR
Universal Robots industrial robot controllers contain hard-coded credentials that allow attackers to reset controller passwords. This affects Universal Robots Robot Controllers CB 3.1 with software version 3.4.5-100, potentially compromising industrial automation systems.
💻 Affected Systems
- Universal Robots Robot Controllers CB 3.1
📦 What is this software?
Cb3.1 Firmware by Universal Robots
⚠️ Risk & Real-World Impact
Worst Case
Complete takeover of industrial robot controllers leading to physical damage, production disruption, or safety hazards in manufacturing environments.
Likely Case
Unauthorized access to robot controllers allowing configuration changes, program manipulation, or data theft from industrial networks.
If Mitigated
Limited impact if controllers are isolated in air-gapped networks with strict access controls and monitoring.
🎯 Exploit Status
Exploitation is straightforward using known hard-coded credentials documented in public advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.4.5-100
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-18-191-01
Restart Required: Yes
Instructions:
1. Contact Universal Robots support for updated firmware. 2. Backup current configuration. 3. Apply firmware update following vendor instructions. 4. Restart controller. 5. Verify new credentials are in use.
🔧 Temporary Workarounds
Network segmentation
allIsolate robot controllers in separate VLANs with strict firewall rules.
Access control lists
allImplement IP-based access restrictions to controller management interfaces.
🧯 If You Can't Patch
- Physically isolate controllers from all networks except required control systems
- Implement continuous monitoring for unauthorized access attempts to controller interfaces
🔍 How to Verify
Check if Vulnerable:
Check controller software version via web interface or UR software. If version is exactly 3.4.5-100, system is vulnerable.Check Version:
Check via Universal Robots PolyScope interface or controller web interfaceVerify Fix Applied:
Verify software version is updated beyond 3.4.5-100 and test that hard-coded credentials no longer work.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful logins
- Password reset events on controller
Network Indicators:
- Unexpected connections to controller management ports (80/443)
- Traffic patterns matching credential brute-forcing
SIEM Query:
source="robot_controller" AND (event="password_reset" OR (auth_failed AND auth_success))