The vulnerability is an OS command injection in the Dashboard Server interface of Universal Robots PolyScope 5. An unauthenticated attacker can craft input that is executed as a system command on the robot, giving full control over the robot’s operating system. This allows arbitrary code execution, compromising confidentiality, integrity, and availability of the robotic system.

All installations of Universal Robots PolyScope 5 with a version earlier than 5.21.1 are affected.

The CVSS score of 9.8 indicates critical severity. The EPSS score is 1%, indicating a low but non-zero probability of exploitation, but the lack of an authentication requirement means the vulnerability is exploitable for any user with network access to the Dashboard Server endpoint. The vulnerability is not listed in CISA’s KEV catalog, yet the high CVSS suggests a high likelihood of exploitation in environments where the interface is exposed. The attack vector is external network access to the robot’s Dashboard Server.