CVE-2026-8153

Full vulnerability record from the local CVENow database.

Description

OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthenticated attacker to craft commands that will execute code on the robot's OS.

Severity

CRITICAL

CVSS score

9.8 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

1b7e193f-2525-49a1-b171-84af8827c9eb

Published

2026-05-08 12:16:29.977000

Last modified

2026-10-26 19:10:00.163000

View original CVE JSON

{
  "id": "CVE-2026-8153",
  "sourceIdentifier": "1b7e193f-2525-49a1-b171-84af8827c9eb",
  "published": "2026-05-08T12:16:29.977",
  "lastModified": "2026-10-26T19:10:00.163",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthenticated attacker to craft commands that will execute code on the robot's OS."
    },
    {
      "lang": "es",
      "value": "Inyección de comandos del sistema operativo en la interfaz del Dashboard Server en versiones de Universal Robots PolyScope anteriores a la 5.21.1 permite a un atacante no autenticado crear comandos que ejecutarán código en el sistema operativo del robot."
    }
  ],
  "affected": [
    {
      "source": "1b7e193f-2525-49a1-b171-84af8827c9eb",
      "affectedData": [
        {
          "vendor": "Universal Robots",
          "product": "PolyScope 5",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "5.25.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "1b7e193f-2525-49a1-b171-84af8827c9eb",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-08T12:46:58.925917Z",
          "id": "CVE-2026-8153",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "1b7e193f-2525-49a1-b171-84af8827c9eb",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.universal-robots.com/developer/communication-protocol/dashboard-server/",
      "source": "1b7e193f-2525-49a1-b171-84af8827c9eb"
    }
  ]
}