OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5

CVE-2026-8153 is an OS command injection bug in the Universal Robots PolyScope 5 Dashboard Server, the text-based remote control interface on TCP 29999. Affected versions are PolyScope 5 releases prior to 5.25.1; if the Dashboard Server is enabled and reachable, an unauthenticated attacker can send crafted input that the controller passes to the underlying robot OS, giving code execution on the controller itself.

The vendor's 9.8 / CRITICAL score is technically fair *if* you model a naked reachable service, but it overstates most enterprise reality. Universal Robots says exploitation requires the Dashboard Server to be enabled and reachable, and its own hardening guidance says new robots and newly created SD cards default security settings to restrictive/disabled from PolyScope 5.17; that turns this from 'internet-grade pre-auth RCE everywhere' into 'high-impact OT controller takeover after a real exposure mistake or internal foothold'.

Why this verdict

• Down from vendor 9.8 for attacker position: this is usually *not* an internet-reachable edge service; it typically requires internal-network access to an OT cell or a specific exposure mistake.
• Further down for configuration gating: the Dashboard Server must be enabled, and Universal Robots documents that services are disabled by default; since PolyScope 5.17, new robots/new SD cards also default security settings to restrictive/disabled.
• Held at HIGH for impact amplification: unauthenticated code execution on a robot controller is not just 'another Linux box'—it can halt production, alter robot behavior, and become a pivot point inside flat OT networks.

Why not higher?

I am not keeping this at CRITICAL because the reachable population is materially narrower than the CVSS label implies. No KEV listing, no confirmed public exploitation in reviewed authoritative sources, and a non-default service exposure requirement all apply downward pressure.

Why not lower?

I am not dropping this to MEDIUM because the exploit chain has no authentication step once the port is reachable, and the technical complexity is low. The consequence is controller compromise on a cyber-physical asset, which means the business impact can jump from one host to a production-line incident very quickly.

1. Disable Dashboard Server where unused — This is the cleanest risk kill-switch because the exploit path dies before packet one. Review each robot/application pair and disable the service on the PolyScope Services screen wherever remote dashboard control is not operationally required; for a HIGH verdict, deploy this within 30 days if patching cannot happen first.
2. Restrict inbound access to trusted hosts and subnets — Use PolyScope General security settings plus upstream firewall rules to allow only the specific engineering stations, PLCs, or management hosts that truly need dashboard access. This directly attacks the main real-world prerequisite—network reachability—and should be in place within 30 days.
3. Segment robot cells from enterprise IT — Treat robot controllers as OT crown jewels, not generic embedded nodes. Put them behind industrial firewalls or tightly filtered conduits, block workstation-to-cell east-west sprawl, and require controlled jump paths; for this HIGH issue, tighten segmentation within 30 days.
4. Monitor TCP 29999 and dashboard activity — Even if you cannot patch immediately, you can make the service noisy. Alert on new sources reaching port 29999, unusual command bursts, controller log anomalies, and any robot-originated lateral movement; stand this up within 30 days.
5. Upgrade to PolyScope 5.25.1 or newer — This is the actual fix and removes the vulnerable code path rather than just constraining access to it. Schedule the appliance-style controller upgrade and complete it within 180 days for a HIGH verdict, validating application compatibility and cell safety after change.

Run this from a trusted auditor workstation that can reach the robot controller over the network; invoke it as bash ur_polyscope_check.sh 192.168.3.3. It needs no credentials and no root, but it does require that the Dashboard Server be enabled and reachable on TCP 29999; otherwise the script will return UNKNOWN.

#!/usr/bin/env bash
# ur_polyscope_check.sh
# Safe version check for Universal Robots PolyScope via Dashboard Server (TCP 29999)
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/runtime error

set -u

FIXED_VERSION="5.25.1"
HOST="${1:-}"
PORT="29999"
TIMEOUT_BIN="$(command -v timeout || true)"

usage() {
  echo "Usage: $0 <robot-ip-or-hostname>"
  exit 3
}

if [[ -z "$HOST" ]]; then
  usage
fi

if [[ -z "$TIMEOUT_BIN" ]]; then
  echo "UNKNOWN - 'timeout' utility not found on this system"
  exit 2
fi

ver_lt() {
  # returns 0 if $1 < $2
  local a b IFS=.
  read -r -a a <<< "$1"
  read -r -a b <<< "$2"
  local len=${#a[@]}
  if (( ${#b[@]} > len )); then len=${#b[@]}; fi
  for ((i=0; i<len; i++)); do
    local ai=${a[i]:-0}
    local bi=${b[i]:-0}
    ((10#$ai < 10#$bi)) && return 0
    ((10#$ai > 10#$bi)) && return 1
  done
  return 1
}

query_dashboard() {
  "$TIMEOUT_BIN" 5 bash -c '
    host="$1"
    port="$2"
    exec 3<>/dev/tcp/${host}/${port} || exit 10
    # Read banner if present; do not fail if absent
    IFS= read -r banner <&3 || true
    printf "PolyscopeVersion\nquit\n" >&3
    IFS= read -r line1 <&3 || true
    IFS= read -r line2 <&3 || true
    printf "%s\n%s\n%s\n" "$banner" "$line1" "$line2"
  ' _ "$1" "$2" 2>/dev/null
}

RESP="$(query_dashboard "$HOST" "$PORT")" || {
  echo "UNKNOWN - dashboard server unreachable, disabled, or blocked on ${HOST}:${PORT}"
  exit 2
}

VERSION="$(printf '%s\n' "$RESP" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1 || true)"

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - could not parse PolyScope version from dashboard response"
  exit 2
fi

if ver_lt "$VERSION" "$FIXED_VERSION"; then
  echo "VULNERABLE - PolyScope ${VERSION} is older than fixed version ${FIXED_VERSION}"
  exit 1
else
  echo "PATCHED - PolyScope ${VERSION} is at or above fixed version ${FIXED_VERSION}"
  exit 0
fi

Sources

1. Universal Robots security advisory for CVE-2026-8153
2. Universal Robots Dashboard Server documentation
3. Universal Robots Dashboard Server PDF command reference
4. Universal Robots PolyScope 5 Software Handbook
5. SecurityWeek coverage with researcher context
6. Dark Reading coverage with OT impact context
7. FIRST EPSS overview and data format
8. CISA Known Exploited Vulnerabilities Catalog