CVE-2020-10291: 
Visual Components License Server vulnerability analysis and mitigation

Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots for planning and decision-making processes. The vulnerability was discovered in Visual Components Network License Server 2.0.8, where the network license server binds to all interfaces (0.0.0.0) and listens on UDP port 5093 without requiring any authentication or authorization (RVD Issue).

The vulnerability exists in the RMS Sentinel license manager service which exposes UDP port 5093. After decryption, the protocol reveals a textual format containing a simple header with requested command, application-identifier, and arguments. The vulnerability has been assigned CVE-2020-10291 and received a CVSS v3.1 Base Score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability allows attackers to retrieve sensitive system information including detailed hardware and OS characteristics, server information, and license information without authentication. This information could be leveraged for further exploitation. Additionally, through Visual Components' PLC Connectivity feature, attackers could potentially pivot from the simulator to industrial machinery including robots or other Industrial Control System (ICS) devices (RVD Issue).

The vulnerability is easily exploitable as it requires no authentication or special access privileges. The attacker only needs network access to the target system running the Visual Components Network License Server to exploit this vulnerability (NVD).