Universal Robots, a leading Danish manufacturer of collaborative industrial robots known as cobots, has recently addressed a significant security issue in one of its operating systems. The vulnerability, which could have exposed robot fleets to hacking, has now been patched.
According to advisories from both the Cybersecurity and Infrastructure Security Agency (CISA) and Universal Robots, the flaw was found in PolyScope 5, an operating system and graphical user interface integral to the operation of the company’s cobots. This security gap, identified as CVE-2026-8153, was an OS command injection vulnerability within the Dashboard Server interface.
Critical Flaw and Its Implications
The vulnerability, which received a critical rating with a CVSS score of 9.8, has been resolved as of version 5.25.1 of PolyScope. The flaw allowed for user-controlled input to be improperly handled, enabling potential remote code execution if exploited by an unauthorized attacker with network access to the Dashboard Server port.
Universal Robots explained that the attack could compromise the robot’s operating system, significantly impacting the confidentiality, integrity, and availability of the controller. However, the exploit requires the Dashboard Server to be enabled and accessible to the attacker, something typically prevented by corporate firewalls.
Expert Insights and Network Vulnerabilities
Vera Mens, a security researcher from Claroty credited with discovering the flaw, emphasized that while many industrial robots lack remote management capabilities, Universal Robots’ cobots include a control box with an Ethernet port. This feature is often used for integration with central management systems or to operate other operational technology (OT) equipment.
Mens noted that these networks are usually not exposed to the public but often lack proper segmentation. This configuration could allow an attacker to gain initial access with relative ease, potentially compromising multiple cobots within a flat network structure.
Potential Risks and Mitigation
The control box of these cobots functions as a general-purpose Linux computer connected to various equipment through Ethernet and serial ports. While the worst-case scenario involves full control over a single cobot, which might pose safety hazards, the implications could escalate to affect entire fleets and their associated peripherals.
In light of these risks, Universal Robots has urged users to update their systems promptly and ensure robust network security practices to prevent unauthorized access. This proactive measure is crucial to maintaining the safety and efficiency of industrial operations reliant on these advanced robotic systems.
Related news discusses similar vulnerabilities in industrial systems, highlighting the ongoing need for vigilance and timely updates in cybersecurity protocols.
