CVE-2021-33016 is a hard-coded-credentials vulnerability (CWE-798) in the KUKA System Software (KSS) that runs on KUKA KR C4 industrial robot controllers: because the credentials are built into the software rather than set per device, an attacker who knows them can gain full read, write, and delete access to sensitive controller folders over the network, and both NVD and the CISA-coordinated advisory rate the flaw 9.8 (critical) on the CVSS v3.1 scale.
Vulnerability summary
9.8
Critical
1.0%
EPSS score (FIRST)
No
CISA KEV catalog
2022-05-26
Published
Vulnerability ID: CVE-2021-33016 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| KUKA KR C4 industrial robot controller running KUKA System Software (KSS) | — | KR C4 control software versions prior to 8.7; any product running KUKA System Software (KSS), per CISA advisory ICSA-21-208-01 |
What does this mean for affected devices?
CVE-2021-33016 (CWE-798, use of hard-coded credentials) affects KUKA System Software (KSS), the control software running on KUKA KR C4 industrial robot controllers. NVD's description states: "An attacker can gain full access (read/write/delete) to sensitive folders due to hard-coded credentials on KUKA KR C4 control software for versions prior to 8.7 or any product running KSS" (NVD).
CISA's coordinated advisory ICSA-21-208-01, "KUKA KR C4," lists KR C4 versions prior to 8.7 and any product running KSS as affected, alongside a companion flaw, CVE-2021-33014, in which hard-coded credentials let an attacker reach a VxWorks shell after login on the same control software. CISA's mitigations are to change the default passwords on KSS 8.3 and later (earlier versions are no longer supported), isolate control systems from the internet and business network, deploy firewalls restricting network access, and use VPNs for any remote access that is genuinely required (CISA ICSA-21-208-01).
Both NVD and the CISA-coordinated metric score the flaw CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, low attack complexity, no privileges or user interaction required (NVD).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01026 (63.8th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).
KR C4 controllers run the motion and safety logic for KUKA's industrial robot arms on factory floors. Operators should update KSS to 8.7 or later, change any hard-coded or default credentials still in use, and keep the controller off networks reachable from the business LAN or internet in the meantime.
Evidence
- An attacker can gain full access (read/write/delete) to sensitive folders due to hard-coded credentials on KUKA KR C4 control software for versions prior to 8.7 or any product running KSS. — NVD
- Affects KR C4 versions prior to 8.7 and any product running KSS; a companion CVE-2021-33014 (hard-coded credentials granting VxWorks shell access) was disclosed in the same advisory; mitigations include changing default passwords on KSS 8.3+ and network isolation. — CISA ICS Advisory ICSA-21-208-01
- CVSS v3.1 base score 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scored identically by NVD and the CISA-coordinated metric. — NVD
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01026 (63.8th percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
