OS Command Injection in iot-embedded (CVE-2026-8153, CVSS 9.8)

Summary

OS command injection in iot-embedded (CVE-2026-8153). Successful exploitation can lead to full system takeover.

Original description

The description as published by the source.

OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.21.1 allows unauthenticated attacker to craft commands that will execute code on the robot's OS.

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A vulnerability in Universal Robots' PolyScope allows unauthorized remote control of robots, posing the risk of unauthorized parties controlling the robots and causing malfunctions. Industries using robots, like manufacturing, need to update their systems quickly.

Universal Robots PolyScope's Dashboard Server interface, allowing remote control via a TCP/IP socket, contains an OS command injection vulnerability that lets attackers execute code on the OS without authentication. Versions affected are prior to 5.21.1, with the issue being patched in 5.21.1. The exploit is critical due to its remote executability and lack of user interaction requirement.

❓ What is the problem

OS command injection in Universal Robots PolyScope's Dashboard Server interface.

📍 Affected scope

Remote control via GUI on a TCP/IP socket (port 29999).

🔥 Severity

Critical (CVSS v3: 9.8) due to unauthenticated remote code execution.

🔧 How to fix

Upgrade to PolyScope version 5.21.1 or later.

🛡️ Workaround

None specified as immediate patching is required.

🔍 Detection

Monitor for unauthorized commands on TCP connections to port 29999.

Related past incidents Similar incidents extracted from past CVEs

CVE-2023-1535

Similar OS command injection vulnerability in IoT device management software.

CVE-2024-6829

Dashboard server vulnerability in industrial robot's UI, leading to remote code execution.

Mirai Botnet

Exploited IoT device vulnerabilities for launching DDoS attacks.

If this happens at your company Expected impact per business scenario

📌 Manufacturing plants using factory robots

An attacker gains control over production line robots, causing operational interruption and potential safety hazards.

📌 Warehousing and logistics robots

Remote control of robots leading to mishandling of goods or disruption of logistics operations.

📌 Healthcare robotics systems

Robot malfunction in sensitive environments such as hospitals, leading to safety risks to patients.

Recommended action

Organizations should urgently update PolyScope to version 5.21.1 or later to mitigate the risk of remote code execution on their robots.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
Audit SBOM/dependencies for affected components.
```
依存マニフェストで影響コンポーネントを特定する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

OS Command Injection in iot-embedded (CVE-2026-8153)