# Critical Command Injection Flaw in Universal Robots Exposes Cobots to Unauthenticated Takeover


## The Threat


Universal Robots, the Danish manufacturer of collaborative robotic systems, has disclosed a critical command injection vulnerability in PolyScope 5 that allows unauthenticated attackers to achieve remote code execution on robot controllers. The flaw, tracked as CVE-2026-8153, exists in the Dashboard Server interface—a core component used to configure and control the company's widely deployed cobots. An attacker with network access to the affected Dashboard Server port can craft malicious commands that bypass input validation, gaining full control of the underlying Linux operating system running the robot controller.


The vulnerability is particularly concerning because it requires no authentication, no user interaction, and no special privileges. An attacker can simply send a specially crafted request over the network and immediately execute arbitrary commands on the industrial control system. Given that collaborative robots are deployed across manufacturing plants, automotive facilities, logistics centers, and healthcare environments worldwide, this flaw introduces significant risk to critical operational technology infrastructure.


Universal Robots has released patches to address the vulnerability, and the company worked with Claroty Team82 researcher Vera Mens on responsible disclosure. The discovery was coordinated through the Cybersecurity and Infrastructure Security Agency (CISA) and CERT/CC's vulnerability information exchange platform, with CISA releasing its own parallel advisory.


## Severity and Impact


| Aspect | Details |

|--------|---------|

| CVE Identifier | CVE-2026-8153 |

| CVSS 3.1 Score | 9.8 (Critical) |

| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |

| CWE | CWE-78: OS Command Injection |

| Attack Vector | Network |

| Attack Complexity | Low |

| Privileges Required | None |

| User Interaction | None |

| Scope | Unchanged |

| Confidentiality Impact | High |

| Integrity Impact | High |

| Availability Impact | High |


The CVSS 9.8 rating reflects the complete compromise potential: an attacker gains full read, write, and execute access to the robot controller's operating system. This enables data theft, malicious code injection, process manipulation, and system shutdown—any of which could disrupt production, cause equipment damage, or pose safety risks to workers in physical proximity to the robots.


## Affected Products


The vulnerability affects the following Universal Robots products:


  • Universal Robots PolyScope 5 (Dashboard Server component)

    • - Versions prior to the patched release


    The flaw is present in the Dashboard Server interface, which is the primary configuration and monitoring tool for Universal Robots PolyScope systems. While PolyScope is the primary affected platform, organizations running any version of Universal Robots collaborative robot systems that rely on the vulnerable Dashboard Server should prioritize verification and patching.


    ## Mitigations


    Immediate Actions:

  • Apply the latest security patch from Universal Robots immediately. The company has released firmware updates that neutralize the command injection flaw by implementing proper input validation and sanitization.
  • Check your network for any Universal Robots systems connected to untrusted networks or exposed to the internet through misconfigured firewalls.

    • Short-Term Controls:

  • Segment Dashboard Server access to trusted networks only. Deploy network-level access controls so that only authorized personnel and systems can reach the Dashboard Server ports (typically port 29999).
  • Restrict outbound connectivity from robot controllers to prevent lateral movement if a controller is compromised.
  • Monitor network traffic to robot controllers for suspicious command patterns or unexpected outbound connections.

    • Operational Best Practices:

  • Implement network segmentation between OT environments and corporate IT networks.
  • Use virtual private networks (VPNs) or firewall rules to limit which machines can access the Dashboard Server.
  • Maintain an accurate inventory of all Universal Robots deployments and their network locations.
  • Review access logs for any evidence of exploitation attempts or successful access from unknown sources.
  • Coordinate patching through your change management process to minimize production disruption.

    • ## References


  • [CISA Advisory on CVE-2026-8153](https://www.cisa.gov/news-events/alerts/) — Official U.S. government vulnerability advisory
  • [Universal Robots Security Advisory](https://www.universal-robots.com/support/) — Patch availability and technical details
  • [Claroty Research on OT Vulnerabilities](https://claroty.com/research) — Security researcher disclosure details

    • ---


    ## HackWire Analysis


    This vulnerability exemplifies a growing and dangerous pattern in operational technology: critical infrastructure systems shipped with fundamental security assumptions that do not hold in modern networked environments. The "no authentication required" aspect is the real story here. In a traditional factory floor where robots lived on isolated networks, an attacker would need physical access or network penetration first. Today, with IoT sprawl, remote monitoring, and cloud integrations, a robot's Dashboard Server can be reachable from a VPN, a compromised contractor laptop, or misconfigured firewall rule away from the internet itself.


    The command injection vector is also instructive. This is not a sophisticated zero-day exploiting a subtle memory corruption or cryptographic weakness. This is input validation—lesson one of secure coding. That a company as mature as Universal Robots shipped an unauthenticated interface that directly passes user input to shell commands suggests either (a) the Dashboard Server was designed before threat modeling of network attackers became standard, or (b) no security review occurred before release. Either scenario is unacceptable for software controlling industrial machinery.


    What makes this particularly urgent is *where* these robots are deployed. Automotive assembly lines, pharmaceutical manufacturing, food processing, healthcare logistics—these are environments where downtime is measured in millions of dollars per hour and failures can impact patient safety. An attacker exploiting CVE-2026-8153 doesn't need to be sophisticated; they need only a network scanner, an exploitation script, and access to the internet. The attack surface includes any organization that has ever allowed remote access to a robot controller for maintenance, any facility with a guest Wi-Fi that can route to the OT network, and any partner or contractor with network connectivity.


    Defenders should assume this vulnerability is already being scanned for at scale. The CVSS 9.8 score and "no authentication required" characteristics make this a high-priority target for both opportunistic attackers and nation-state actors focused on industrial disruption. Organizations should patch today, not next quarter.


    — *HackWire Editorial*


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)