Researchers of IoT security at Cynerio have discovered five (5) high severity vulnerabilities in autonomous robots operating in hospitals. These vulnerabilities, known as “JekyllBot:5”, affect the Aethon TUG autonomous robots that move equipment and food autonomously throughout medical facilities. This autonomous capability means that these robots have access to potentially restricted parts of facilities, as well as having access to patient information. Additionally, the onboard camera used to help the robots navigate can also be compromised, leading to the ability to surveil inside these facilities. Leveraging these vulnerabilities could allow an attacker to take control of the robot, remotely piloting it to potentially surveil an area or intentionally cause physical damage. The vulnerability is related to a lack of authorization and identity checks, which enables new admin users to be added to the system without authentication. Once access to the TUG portal is granted, threat actors have the ability to move laterally across the medical facility network, causing a greater breach and the ability for more malware to be deployed. Firmware patches have already been deployed by the vendor to counter these specific vulnerabilities, but the incident raises questions about the increasing use of IoT in medical facilities. CTIX analysts will continue to monitor vulnerabilities for medical devices in the IoT field as these kinds of vulnerabilities continue to evolve.