This vulnerability (CVE-2026-8153) involves improper neutralization of special elements used in OS commands (CWE-78) within the Dashboard Server interface of Universal Robots PolyScope 5. It allows unauthenticated remote attackers to execute arbitrary OS commands on affected versions prior to 5.25.1. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation level is currently documented.

Successful exploitation enables remote unauthenticated attackers to execute arbitrary code on the robot's operating system, potentially leading to full system compromise. This can result in complete loss of confidentiality, integrity, and availability of the affected device. Given the critical CVSS score, the impact is severe for environments relying on Universal Robots PolyScope 5 prior to version 5.25.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Dashboard Server interface to trusted users only and monitor for unusual activity. Avoid exposing the interface to untrusted networks. Follow updates from Universal Robots for official patches or mitigations.