CVE-2018-10635 is a missing-authentication vulnerability (CWE-306) in the CB 3.1 controller firmware of Universal Robots' UR3, UR5, and UR10 collaborative robot arms: ports 30001 through 30003/TCP listen for arbitrary URScript code and execute whatever is sent to them with no authentication check, so a remote attacker who can reach those ports over the network can run arbitrary code and potentially obtain root access to the controller, a flaw NVD rates 9.8 (critical) on the CVSS v3.0 scale.
Vulnerability summary
9.8
Critical
5.0%
EPSS score (FIRST)
No
CISA KEV catalog
2018-07-11
Published
Vulnerability ID: CVE-2018-10635 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Universal Robots CB 3.1 robot controller firmware (UR3, UR5, UR10 collaborative arms) | — | CB 3.1 controller, SW Version 3.4.5-100, per CISA advisory ICSA-18-191-01 |
What does this mean for affected devices?
CVE-2018-10635 (CWE-306, missing authentication for a critical function) affects the CB 3.1 controller firmware of Universal Robots' collaborative robot arms. NVD's description states: "In Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100, ports 30001/TCP to 30003/TCP listen for arbitrary URScript code and execute the code. This enables a remote attacker who has access to the ports to remotely execute code that may allow root access to be obtained" (NVD).
CISA's advisory ICSA-18-191-01, "Universal Robots Robot Controllers," confirms the affected product as CB 3.1, SW Version 3.4.5-100, and lists a companion flaw in the same advisory, CVE-2018-10633, in which hard-coded credentials let an attacker reset the controller's passwords. CISA's mitigations are to block ports 30001-30003/TCP at the firewall, isolate the robots from the internet and business network, limit physical access to control boxes and teach pendants, deploy the devices behind properly segmented firewalls, and use VPNs for any remote access that is genuinely required (CISA ICSA-18-191-01).
NVD scores the flaw CVSS v3.0 9.8 (critical), vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, low attack complexity, no privileges or user interaction required (NVD).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.05034 (92.3rd percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).
UR3, UR5, and UR10 cobots are widely deployed on factory and lab floors working alongside people. Operators running CB 3.1 firmware should block the 30001-30003/TCP range at the network boundary, keep the controller off any network reachable from the internet or business LAN, and plan an upgrade path to a supported controller generation, since CB 3.1 itself is long out of vendor support.
Evidence
- Ports 30001/TCP to 30003/TCP listen for arbitrary URScript code and execute the code; a remote attacker with access to the ports can remotely execute code that may allow root access to be obtained. — NVD
- Confirmed affected product: CB 3.1, SW Version 3.4.5-100; a companion CVE-2018-10633 (hard-coded credentials allowing password reset) was disclosed in the same advisory; mitigations include blocking ports 30001-30003/TCP and network isolation. — CISA ICS Advisory ICSA-18-191-01
- CVSS v3.0 base score 9.8 (critical), vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, an NVD Primary score. — NVD
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.05034 (92.3rd percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
