{"resultsPerPage":12,"startIndex":0,"totalResults":12,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-20T19:00:13.225","vulnerabilities":[{"cve":{"id":"CVE-2022-2675","sourceIdentifier":"cve@rapid7.com","published":"2022-08-05T17:15:08.857","lastModified":"2026-06-17T04:42:19.753","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Using off-the-shelf commodity hardware, the Unitree Go 1 robotics platform version H0.1.7 and H0.1.9 (using firmware version 0.1.35) can be powered down by an attacker within normal RF range without authentication. Other versions may be affected, such as the A1."},{"lang":"es","value":"Usando hardware comercial, la plataforma robótica Unitree Go 1 versiones H0.1.7 y H0.1.9 (usando la versión de firmware 0.1.35) puede ser apagada por un atacante dentro del rango normal de RF sin autenticación. Otras versiones pueden estar afectadas, como la A1"}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Unitree","product":"Go 1","platforms":["H0.1.7"],"versions":[{"version":"0.1.35","lessThanOrEqual":"0.1.35","versionType":"custom","status":"affected"}]},{"vendor":"Unitree","product":"Go 1","platforms":["H0.1.9"],"versions":[{"version":"0.1.35","lessThan":"0.1.35","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go_1_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"0.1.35","matchCriteriaId":"8C77CEE9-1D52-4232-B246-2DD22AB67164"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go_1:h0.1.7:*:*:*:*:*:*:*","matchCriteriaId":"D11F4C4B-BBC2-4DEF-B007-F4A41B63B73F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go_1_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"0.1.35","matchCriteriaId":"769D23CA-EB8D-47AB-BA82-80171020F1F2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go_1:h0.1.9:*:*:*:*:*:*:*","matchCriteriaId":"A1B1F3C7-D3F5-4390-9C53-DFF17EE6DA3A"}]}]}],"references":[{"url":"https://fccid.io/2A5PE-YUSHU001/Users-Manual/User-Manual-5810729","source":"cve@rapid7.com","tags":["Product","Third Party Advisory"]},{"url":"https://twitter.com/d0tslash/status/1555326302462394370","source":"cve@rapid7.com","tags":["Third Party Advisory"]},{"url":"https://www.mybotshop.de/Datasheet/Unitree_A1_User_Manual_v1.0.pdf","source":"cve@rapid7.com","tags":["Product","Third Party Advisory"]},{"url":"https://fccid.io/2A5PE-YUSHU001/Users-Manual/User-Manual-5810729","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product","Third Party Advisory"]},{"url":"https://twitter.com/d0tslash/status/1555326302462394370","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.mybotshop.de/Datasheet/Unitree_A1_User_Manual_v1.0.pdf","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2025-45467","sourceIdentifier":"cve@mitre.org","published":"2025-07-25T15:15:29.283","lastModified":"2026-06-17T09:25:31.360","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an insecure verification mechanism that solely relies on MD5 checksums for firmware integrity validation."},{"lang":"es","value":"Unitree Go1 &lt;= Go1_2022_05_11 es vulnerable a permisos inseguros ya que la funcionalidad de actualización de firmware (a través de Wi-Fi/Ethernet) implementa un mecanismo de verificación inseguro que se basa únicamente en sumas de comprobación MD5 para la validación de la integridad del firmware."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-07-25T20:18:37.590700Z","id":"CVE-2025-45467","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-276"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3A800D2C-2D63-452E-B234-DE9CA4E5C127"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go1:-:*:*:*:*:*:*:*","matchCriteriaId":"8E8C711A-D435-40B3-9399-FBA7105BE1AD"}]}]}],"references":[{"url":"https://github.com/zgsnj123/CVE-2025-45467/tree/main","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.unitree.com/cn/go1","source":"cve@mitre.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2025-45466","sourceIdentifier":"cve@mitre.org","published":"2025-07-25T16:15:33.737","lastModified":"2026-06-17T09:25:31.197","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext."},{"lang":"es","value":"Unitree Go1 &lt;= Go1_2022_05_11 es vulnerable a un control de acceso incorrecto debido a que las credenciales de autenticación están codificadas en texto sin formato."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-07-25T15:28:48.537770Z","id":"CVE-2025-45466","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-798"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3A800D2C-2D63-452E-B234-DE9CA4E5C127"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go1:-:*:*:*:*:*:*:*","matchCriteriaId":"8E8C711A-D435-40B3-9399-FBA7105BE1AD"}]}]}],"references":[{"url":"https://github.com/zgsnj123/CVE-2025-45466","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.unitree.com/cn/go1","source":"cve@mitre.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2025-60017","sourceIdentifier":"cve@mitre.org","published":"2025-09-26T01:15:36.883","lastModified":"2026-10-18T21:10:00.120","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass parameter (within restart_wifi_ap and restart_wifi_sta)."},{"lang":"es","value":"Los dispositivos Unitree Go2, G1, H1 y B2 hasta el 2025-09-20 permiten la inyección de comandos del SO como root a través del parámetro wifi_ssid o wifi_pass de hostapd_restart.sh (dentro de restart_wifi_ap y restart_wifi_sta)."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Unitree","product":"Go2","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2025-09-20","versionType":"custom","status":"affected"}]},{"vendor":"Unitree","product":"G1","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2025-09-20","versionType":"custom","status":"affected"}]},{"vendor":"Unitree","product":"H1","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2025-09-20","versionType":"custom","status":"affected"}]},{"vendor":"Unitree","product":"B2","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2025-09-20","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-09-26T19:16:47.361122Z","id":"CVE-2025-60017","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/Bin4ry/UniPwn","source":"cve@mitre.org"},{"url":"https://news.ycombinator.com/item?id=45381590","source":"cve@mitre.org"},{"url":"https://spectrum.ieee.org/unitree-robot-exploit","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2025-60250","sourceIdentifier":"cve@mitre.org","published":"2025-09-26T01:15:37.060","lastModified":"2026-10-18T21:10:00.120","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the df98b715d5c6ed2b25817b6f2554124a key and the 2841ae97419c2973296a0d4bdfe19a4f IV."},{"lang":"es","value":"Los dispositivos Unitree Go2, G1, H1 y B2 hasta el 20 de septiembre de 2025 descifran datos de paquetes BLE mediante el uso de la clave df98b715d5c6ed2b25817b6f2554124a y el IV 2841ae97419c2973296a0d4bdfe19a4f."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Unitree","product":"Go2","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2025-09-20","versionType":"custom","status":"affected"}]},{"vendor":"Unitree","product":"G1","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2025-09-20","versionType":"custom","status":"affected"}]},{"vendor":"Unitree","product":"H1","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2025-09-20","versionType":"custom","status":"affected"}]},{"vendor":"Unitree","product":"B2","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2025-09-20","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-09-26T19:17:45.577110Z","id":"CVE-2025-60250","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://github.com/Bin4ry/UniPwn","source":"cve@mitre.org"},{"url":"https://news.ycombinator.com/item?id=45381590","source":"cve@mitre.org"},{"url":"https://spectrum.ieee.org/unitree-robot-exploit","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2025-60251","sourceIdentifier":"cve@mitre.org","published":"2025-09-26T01:15:37.240","lastModified":"2026-10-18T21:10:00.120","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unitree Go2, G1, H1, and B2 devices through 2025-09-20 accept any handshake secret with the unitree substring."},{"lang":"es","value":"Dispositivos Unitree Go2, G1, H1 y B2 hasta el 20 de septiembre de 2025 aceptan cualquier secreto de handshake con la subcadena unitree."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Unitree","product":"Go2","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2025-09-20","versionType":"custom","status":"affected"}]},{"vendor":"Unitree","product":"G1","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2025-09-20","versionType":"custom","status":"affected"}]},{"vendor":"Unitree","product":"H1","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2025-09-20","versionType":"custom","status":"affected"}]},{"vendor":"Unitree","product":"B2","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2025-09-20","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-09-26T14:49:33.822843Z","id":"CVE-2025-60251","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/Bin4ry/UniPwn","source":"cve@mitre.org"},{"url":"https://news.ycombinator.com/item?id=45381590","source":"cve@mitre.org"},{"url":"https://spectrum.ieee.org/unitree-robot-exploit","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2025-35027","sourceIdentifier":"cve@takeonme.org","published":"2025-09-26T07:15:41.413","lastModified":"2026-10-18T21:10:00.120","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script. All Unitree models use firmware derived from the same codebase (MIT Cheetah), and the two major forks are the G1 (humanoid) and Go2 (quadruped) branches."},{"lang":"es","value":"Múltiples productos robóticos de Unitree que comparten un firmware común, incluyendo los dispositivos Go2, G1, H1 y B2, contienen una vulnerabilidad de inyección de comandos. Al establecer una cadena maliciosa al configurar el WiFi integrado a través de un módulo BLE de un robot afectado, y luego al activar un reinicio del servicio WiFi, un atacante puede finalmente activar comandos para que se ejecuten como root a través del script de shell wpa_supplicant_restart.sh. Todos los modelos de Unitree usan firmware derivado de la misma base de código (MIT Cheetah), y las dos bifurcaciones principales son las ramas G1 (humanoide) y Go2 (cuadrúpedo)."}],"affected":[{"source":"cve@takeonme.org","affectedData":[{"vendor":"Unitree","product":"Go2","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.1.8","versionType":"semver","status":"affected"}]},{"vendor":"Unitree","product":"G1","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.4.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@takeonme.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-09-30T18:04:59.805441Z","id":"CVE-2025-35027","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@takeonme.org","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:g1_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.4.4","matchCriteriaId":"744A7CDD-60D1-4470-A1B6-D6E6C53E503A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:g1:-:*:*:*:*:*:*:*","matchCriteriaId":"3DA4F27A-A866-4BA1-B478-A5AE95538D8A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go2_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.1.8","matchCriteriaId":"9252B926-EB5E-417C-BCA3-EE5019DDDCBD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go2:-:*:*:*:*:*:*:*","matchCriteriaId":"372BB5C0-26D8-4E99-A63E-F4FB2D0A50C2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:h1_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.4.4","matchCriteriaId":"49891C76-47D0-4421-B32A-8EBE95F8A7B0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:h1:-:*:*:*:*:*:*:*","matchCriteriaId":"FA6B3BA8-EB04-43B6-9149-D88A3C59722B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:b2_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.1.8","matchCriteriaId":"63F0F035-178A-4395-9268-8A4A4218AFD4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:b2:-:*:*:*:*:*:*:*","matchCriteriaId":"1CFABD84-B19D-4056-BC3C-5EFAF6EF7719"}]}]}],"references":[{"url":"https://github.com/Bin4ry/UniPwn","source":"cve@takeonme.org","tags":["Exploit","Technical Description"]},{"url":"https://spectrum.ieee.org/unitree-robot-exploit","source":"cve@takeonme.org","tags":["Press/Media Coverage"]},{"url":"https://takeonme.org/cves/cve-2025-35027","source":"cve@takeonme.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cve.org/cverecord?id=CVE-2025-60017","source":"cve@takeonme.org","tags":["Third Party Advisory"]},{"url":"https://www.cve.org/cverecord?id=CVE-2025-60250","source":"cve@takeonme.org","tags":["Third Party Advisory"]},{"url":"https://x.com/committeeonccp/status/1971250635548033311","source":"cve@takeonme.org","tags":["Press/Media Coverage"]},{"url":"https://github.com/Bin4ry/UniPwn","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Technical Description"]}]}},{"cve":{"id":"CVE-2026-27509","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-02-26T20:31:38.447","lastModified":"2026-06-17T10:27:16.610","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pressed, the code executes as root and the binding persists across reboots."},{"lang":"es","value":"Las versiones de firmware de Unitree Go2 V1.1.7 a V1.1.9 y V1.1.11 (EDU) no implementan autenticación ni autorización DDS para el tema de Eclipse CycloneDDS rt/api/programming_actuator/request gestionado por actuator_manager.py. Un atacante adyacente a la red y no autenticado puede unirse al dominio DDS 0 y publicar un mensaje manipulado (api_id=1002) que contiene Python arbitrario, el cual el robot escribe en el disco bajo /unitree/etc/programming/ y lo vincula a una asignación de teclas de un controlador físico. Cuando se pulsa la asignación de teclas, el código se ejecuta como root y la vinculación persiste a través de los reinicios."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"UnitreeRobotics","product":"Unitree Go2","defaultStatus":"unaffected","versions":[{"version":"1.1.7","lessThanOrEqual":"1.1.9","versionType":"semver","status":"affected"},{"version":"1.1.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-27T17:53:39.495825Z","id":"CVE-2026-27509","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go2_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"1.1.7","versionEndIncluding":"1.1.9","matchCriteriaId":"2736E1DA-AA06-4AEE-8EEC-4731BF3A4AB6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go2:-:*:*:*:*:*:*:*","matchCriteriaId":"372BB5C0-26D8-4E99-A63E-F4FB2D0A50C2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go2_edu_firmware:1.1.11:*:*:*:*:*:*:*","matchCriteriaId":"F5D56F44-88E0-4091-AC92-CEB384C5F86C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go2_edu:-:*:*:*:*:*:*:*","matchCriteriaId":"5D8501EA-2CCC-4615-92FD-A3C46A71FEAE"}]}]}],"references":[{"url":"https://boschko.ca/unitree-go2-rce/","source":"disclosure@vulncheck.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://shop.unitree.com/products/unitree-go2","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://www.vulncheck.com/advisories/unitree-go2-missing-dds-authentication-enables-adjacent-rce","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-27510","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-02-26T20:31:38.663","lastModified":"2026-06-17T10:27:16.740","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLite database (unitree_go2.db, table dog_programme) and transmits the programme_text content, including the pyCode field, to the robot. The robot's actuator_manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can tamper with the stored programme record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the application's community marketplace can result in arbitrary code execution on any robot that imports and runs it."},{"lang":"es","value":"Las versiones de firmware de Unitree Go2 1.1.7 a 1.1.11, cuando se usan con la aplicación de Android Unitree Go2 (com.unitree.doggo2), son vulnerables a la ejecución remota de código debido a la falta de protección de integridad y validación de programas creados por el usuario. La aplicación de Android almacena programas en una base de datos SQLite local (unitree_go2.db, tabla dog_programme) y transmite el contenido de programme_text, incluido el campo pyCode, al robot. El archivo actuator_manager.py del robot ejecuta el Python suministrado como root sin verificación de integridad o validación de contenido. Un atacante con acceso local al dispositivo Android puede manipular el registro de programa almacenado para inyectar Python arbitrario que se ejecuta cuando el usuario activa el programa a través de una asignación de tecla del controlador, y la asignación maliciosa persiste a través de los reinicios. Además, un programa malicioso compartido a través del mercado comunitario de la aplicación puede resultar en la ejecución de código arbitrario en cualquier robot que lo importe y ejecute."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"UnitreeRobotics","product":"Unitree Go2","defaultStatus":"unaffected","versions":[{"version":"1.1.7","lessThanOrEqual":"1.1.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-26T21:09:46.113186Z","id":"CVE-2026-27510","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go2_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"1.1.7","versionEndIncluding":"1.1.11","matchCriteriaId":"7E214A36-96C5-47AB-89FA-5891DFC99288"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go2:-:*:*:*:*:*:*:*","matchCriteriaId":"372BB5C0-26D8-4E99-A63E-F4FB2D0A50C2"}]}]}],"references":[{"url":"https://boschko.ca/unitree-go2-rce/","source":"disclosure@vulncheck.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://shop.unitree.com/products/unitree-go2","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://www.vulncheck.com/advisories/unitree-go2-mobile-program-tampering-enables-root-rce","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-1442","sourceIdentifier":"cve@takeonme.org","published":"2026-02-27T05:18:18.713","lastModified":"2026-06-17T10:15:47.863","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models. This issue appears to affect all of Unitree’s current offerings as of February 26, 2026, and so should be considered a vulnerability in both the firmware generation and extraction processes. At the time of this release, there is no publicly-documented mechanism to subvert the update process and insert poisoned firmware packages without the equipment owner’s knowledge."},{"lang":"es","value":"Dado que el algoritmo de cifrado utilizado para proteger las actualizaciones de firmware está a su vez cifrado utilizando material clave disponible para un atacante (o cualquiera que preste atención), las actualizaciones de firmware pueden ser alteradas por un usuario no autorizado, y luego confiadas por un producto Unitree, como el Unitree Go2 y otros modelos. Este problema parece afectar a todas las ofertas actuales de Unitree a partir del 26 de febrero de 2026, y por lo tanto debe considerarse una vulnerabilidad tanto en los procesos de generación como de extracción de firmware. En el momento de esta publicación, no existe un mecanismo documentado públicamente para subvertir el proceso de actualización e insertar paquetes de firmware envenenados sin el conocimiento del propietario del equipo."}],"affected":[{"source":"cve@takeonme.org","affectedData":[{"vendor":"Unitree","product":"UPK","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"20260226v1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@takeonme.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"cve@takeonme.org","ssvcData":{"options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CNA","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-27T15:55:47.935645Z","id":"CVE-2026-1442","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@takeonme.org","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go2_edu_plus_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"26D4BC75-48FB-415E-A2E7-CF0C70C91740"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go2_edu_plus:-:*:*:*:*:*:*:*","matchCriteriaId":"9AE1CAC4-BD1B-4449-8735-C09DE5C3AACE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go1_pro_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E7321D3B-6F10-45C8-9C0B-FDFC02B0A393"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go1_pro:-:*:*:*:*:*:*:*","matchCriteriaId":"06D2B494-B3A0-4FA8-99A8-F52EF5C317C2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go1_air_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"13B7973E-1018-44F0-A070-5B1D0A4AD0AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go1_air:-:*:*:*:*:*:*:*","matchCriteriaId":"BDB92A00-F973-4A6A-A4DF-55B1E05F075B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go2_x_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"56D71A36-EC3E-4C55-BDC4-876D78B17148"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go2_x:-:*:*:*:*:*:*:*","matchCriteriaId":"CBB316DA-DEC5-4BD4-A314-8AF480632868"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go2_pro_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"68718176-2ECF-4F6B-8012-D753FE43BA97"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go2_pro:-:*:*:*:*:*:*:*","matchCriteriaId":"14007E03-A338-48EA-8DCD-DEF3970AA5D8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go2_air_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"45AFB2CB-9E22-417D-BB7E-05C694381FCD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go2_air:-:*:*:*:*:*:*:*","matchCriteriaId":"DB35DA4B-ABEA-493A-BB11-63AA72DAE05C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:unitree:go2_edu_standard_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"58C9389B-B19D-459E-B1ED-342475B5F588"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:unitree:go2_edu_standard:-:*:*:*:*:*:*:*","matchCriteriaId":"73B985D2-B874-467B-8629-46F01E785BD7"}]}]}],"references":[{"url":"http://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000001111111111110101111111111000000000000000000000000000000000000000000000000000000101","source":"cve@takeonme.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/Bin4ry/UniTEABag","source":"cve@takeonme.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.linkedin.com/posts/kevin-finisterre-6431069a_in-case-you-want-to-teabag-unitree-robotics-activity-7432984361014091776-zB4D","source":"cve@takeonme.org","tags":["Third Party Advisory"]},{"url":"https://x.com/bin4rydigit/status/2027197985625420242","source":"cve@takeonme.org","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-76639","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-27T20:18:38.230","lastModified":"2026-09-08T20:23:49.880","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, plant a malicious payload in its script execution directory via path traversal, and trigger execution of that payload as uid 0 through the bashrunner shell subprocess."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Unitree Robotics","product":"G1 EDU","defaultStatus":"affected","versions":[{"version":"0","lessThanOrEqual":"1.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-31T16:06:02.393152Z","id":"CVE-2026-76639","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://boschko.ca/g1-ble-rce/","source":"disclosure@vulncheck.com"},{"url":"https://github.com/OlivierLaflamme/UniBLEed","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/unitree-g1-edu-unauthenticated-rce-via-dds-bridge-and-path-traversal","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-76640","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-27T20:18:38.380","lastModified":"2026-09-08T20:23:49.880","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi provisioning script and a buffer overflow in the SSID chunk accumulator. Attackers can send crafted BLE writes to overflow a fixed BSS buffer across BLE connections, corrupting an adjacent mainloop function pointer dispatch entry that is subsequently invoked by the cleanup path passing attacker-controlled data to system() as uid 0."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Unitree Robotics","product":"G1 EDU","defaultStatus":"affected","versions":[{"version":"0","lessThanOrEqual":"1.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-28T15:53:04.108003Z","id":"CVE-2026-76640","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://boschko.ca/g1-ble-rce/","source":"disclosure@vulncheck.com"},{"url":"https://github.com/OlivierLaflamme/UniBLEed","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/unitree-g1-edu-ble-gatt-rce-via-wifi-provisioning-stack","source":"disclosure@vulncheck.com"}]}}]}