CVE-2020-10286— RVD#3323: Mismanaged permission implementation leads to privilege escalation, exfiltration of sensitive information, and DoS
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-10286
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RVD#3323: Mismanaged permission implementation leads to privilege escalation, exfiltration of sensitive information, and DoS
Source: NVD (National Vulnerability Database)
Vulnerability Description
the main user account has restricted privileges but is in the sudoers group and there is not any mechanism in place to prevent sudo su or sudo -i to be run gaining unrestricted access to sensible files, encryption, or issue orders that disrupt robot operation.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
依赖构建于封闭的安全性
Source: NVD (National Vulnerability Database)
Vulnerability Title
uFactory xArm5 Lite、xArm6和xArm7 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
uFactory xArm5 Lite 1.5.0之前版本，xArm6和xArm7中存在安全漏洞。攻击者可利用该漏洞提升权限，获取敏感信息或造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| uFactory | xArm 5 Lite, xArm 6 and xArm 7 | v1.5.0 and before | - |
II. Public POCs for CVE-2020-10286
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-10286
请登录查看更多情报信息。
- https://github.com/aliasrobotics/RVD/issues/3323x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2020-10286
Same Patch Batch · uFactory · 2020-07-15 · 3 CVEs total
| CVE-2020-10284 | RVD#3321: No Authentication required to exert manual control of the robot | |
| CVE-2020-10285 | RVD#3322: Weak authentication implementation make the system vulnerable to a brute-force a |
IV. Related Vulnerabilities
Same weakness: CWE-656
- CVE-2026-7161
GeoVision GV-IP Device Utility Device Authentication insuffi - CVE-2026-42363
GeoVision GV-IP Device Utility Device Authentication insuffi - CVE-2025-59093
Insecure Password Derivation Function for Database Administr - CVE-2025-7020
BYD DiLink OS Incorrect encryption Implementation of system - CVE-2024-12297
Frontend Authorization Logic Disclosure Vulnerability
V. Comments for CVE-2020-10286
No comments yet