Unpatched Flaw Leaves Industrial Robot Fleets Remotely Accessible to Unauthorized Operators

A vulnerability in industrial robot control systems permits remote operation without authentication. The robots are large. They move. They are now accessible to parties who do not work at the facility. The manufacturer has not released a patch. Facilities continue operating the robots.

This follows the pattern where networked industrial equipment was assumed to operate in trusted environments. The assumption was documented in design specs from 2015. Nobody filed a change request when the equipment became internet-connected. The vulnerability was discovered during routine auditing. Routine auditing happens rarely.

The patch, when released, will require facilities to schedule downtime. Scheduling downtime requires coordination between shift supervisors and procurement. Some facilities will not apply the patch. They will file a risk acceptance form instead. The robots will continue moving without oversight.