The vulnerability is an OS command injection in the Dashboard Server interface of Universal Robots PolyScope 5. An unauthenticated attacker can send crafted input that is executed as a system command on the robot’s operating system, allowing arbitrary code execution and full compromise of the robot’s confidentiality, integrity, and availability.

All installations of Universal Robots PolyScope 5 with a version earlier than 5.25.1 are affected.

The CVSS score of 9.8 indicates critical severity. The EPSS score is 1%, indicating a low but non-zero probability of exploitation, but the lack of an authentication requirement means the vulnerability is exploitable for any user with network access to the Dashboard Server endpoint. The vulnerability is not listed in CISA’s KEV catalog, yet the high CVSS suggests a high likelihood of exploitation in environments where the interface is exposed. The attack vector is external network access to the robot’s Dashboard Server.