title: OmniCore RobotWare Missing Authentication Vulnerability
description: A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and modify files on the robot controller if the attacker has access to the Connected Services Gateway Ethernet port.
problem types: CWE-306 Missing Authentication for Critical Function
affected:
{
product: RobotWare
vendor: ABB
versions:
lessThan: 7.3.2, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: The problem is corrected in RobotWare version 7.3.2.
ABB recommends that customers apply the update at earliest convenience. The update is available for download from RobotStudio.
workarounds: ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors:
• Do not use Connected Services Ethernet port connection until the update has been applied, or
• Protect Connected Services Gateway Ethernet port with a firewall, which prevents inbound connections.