Why cobots are an attractive target
A cobot's controller is a networked computer that can load and run programs, change speeds and, if the safety configuration is unprotected, change the limits that keep people safe. Cobots usually work next to people without fencing, so a compromised cobot is a safety issue as well as a downtime issue.
Cobots are also often installed by small teams or integrators under time pressure. Remote interfaces get switched on for convenience during commissioning and are never switched off.
The interfaces attackers look for
Universal Robots is the most common example. Its controllers expose several TCP services, and other cobot brands have similar interfaces under different names.
| Interface | Default port | Why it matters |
|---|---|---|
| Dashboard Server | 29999 | Text commands to load, start, stop and power the robot, with no login. CVE-2026-8153 allowed remote code execution through it on PolyScope 5 before 5.25.1. |
| Primary and secondary client interfaces | 30001 / 30002 | Accept robot scripts that can move the arm |
| Real-time interface | 30003 | Streams robot state and accepts script commands |
| RTDE | 30004 | Real-time data exchange used by integrations and dashboards |
| Modbus TCP server | 502 | Reads and writes registers and I/O |
Anyone who can reach these ports can usually use them. For most cobot interfaces, controlling who can reach them on the network matters more than any password.
Cobot hardening checklist
- Segment. Put each cobot or cell on its own VLAN behind a firewall. Allow only the PLC, HMI and systems it needs.
- Switch off unused interfaces. Turn off the Dashboard Server and other remote services nothing uses. On PolyScope 5, these are in the robot's security settings.
- Restrict what stays on. If an interface must stay on, use firewall rules so only specific hosts can reach it.
- Protect the safety configuration. Set a strong safety password, separate from the general operator password, and don't write either on a label.
- Patch. Track vendor security advisories and update controller software in planned maintenance windows. Universal Robots users on PolyScope 5 should be on 5.25.1 or later.
- Review plugins. Remove unused URCaps or plugins, and install them only from trusted sources.
- Control USB. Decide who can load programs from USB drives, and record program changes.
- Broker vendor access. Remove always-on remote access tools from cell PCs. Use approved, time-limited, recorded sessions.
- Back up. Back up programs and installation files after every approved change, and keep versions.
- Write the recovery plan. Record who to call, how to make the cell safe and where the backups are.
Safety and security are connected
ISO 10218-1:2025, the industrial robot safety standard, now includes cybersecurity requirements to the extent they apply to robot safety. In the EU, the Machinery Regulation applies from 20 January 2027 and requires machinery to be protected against corruption that could lead to hazardous situations. A cobot risk assessment should therefore ask who could change its programs or safety settings over the network. See the EU rules for robots.
Common questions
Are cobots more vulnerable than industrial robots?
Not inherently. But cobots are more often connected straight to plant networks and installed without a security review, so their remote interfaces are more often reachable.
Can a hacked cobot hurt someone?
If an attacker can change programs or the safety configuration, the cobot could behave unexpectedly near people. Independent safety functions and a protected safety configuration reduce that risk, which is why both matter.
How do I check whether a Universal Robots Dashboard Server is reachable?
From a computer on a network that should not reach the robot, test TCP port 29999 on the robot's address, for example with Test-NetConnection <robot-ip> -Port 29999 in PowerShell. If it connects, the interface is reachable from there.
Robot cell acting up?
24/7 robot incident line: 646-560-5083. Not urgent? Book an exposure assessment and an engineer replies within one business day.