CVE-2020-10287
📋 TL;DR
ABB IRC5 industrial robot controllers with UAS service enabled use publicly documented default credentials that are often not changed in production systems. This allows attackers to gain unauthorized access to industrial control systems. Organizations using ABB IRC5 robots with UAS service are affected.
💻 Affected Systems
- ABB IRC5 robot controllers
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial robot controllers leading to physical damage, production disruption, or safety hazards through unauthorized control of robotic systems.
Likely Case
Unauthorized access to robot controllers enabling configuration changes, data theft, or disruption of manufacturing operations.
If Mitigated
No impact if default credentials are changed and proper access controls are implemented.
🎯 Exploit Status
Exploitation requires only knowledge of default credentials which are publicly documented. No special tools or skills needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://github.com/aliasrobotics/RVD/issues/3326
Restart Required: No
Instructions:
1. Access IRC5 controller interface
2. Navigate to UAS service configuration
3. Change default credentials to strong, unique passwords
4. Document new credentials securely
5. Verify old credentials no longer work
🔧 Temporary Workarounds
Disable UAS Service
allDisable the Universal Access Service if not required for operations
Specific commands depend on RobotWare version and interface
Network Segmentation
allIsolate IRC5 controllers from untrusted networks using firewalls
🧯 If You Can't Patch
- Implement strict network access controls to limit access to IRC5 controllers
- Enable logging and monitoring for authentication attempts to UAS service
🔍 How to Verify
Check if Vulnerable:
Attempt to authenticate to UAS service using publicly documented default credentials for ABB IRC5Check Version:
Check RobotWare version through controller interface or diagnostic toolsVerify Fix Applied:
Verify default credentials no longer work and only new, strong credentials provide access📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts to UAS service
- Successful logins from unexpected sources
- Configuration changes to robot controllers
Network Indicators:
- Unauthorized access attempts to UAS service ports
- Traffic patterns indicating credential guessing
SIEM Query:
source="irc5_controller" AND (event_type="authentication" AND result="success") AND user="default_user"