CVE-2021-33014

Name of the Vulnerable Software and Affected Versions KUKA KR C4 control software versions prior to 8.7 Any product running KSS

Description The issue is related to the use of hard-coded credentials in the KUKA KR C4 control software and the KSS operating system. An attacker can exploit this to gain full access to the vulnerable system, specifically obtaining VxWorks Shell after login. This can be done remotely.

Recommendations For KUKA KR C4 control software versions prior to 8.7, update to version 8.7 or later to resolve the issue. For any product running KSS, consider changing the default credentials to custom, secure ones to minimize the risk of exploitation. As a temporary workaround, restrict access to the system to prevent unauthorized login attempts until a patch is applied.