Unitree Go2 vulnerabilities
6 vulnerabilities
Known vulnerabilities in Unitree Go2, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2025-60017unitree · b2_firmware +3 moreunitree b2_firmwareUnitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass parameter (within restart_wifi_ap and restart_wifi_sta).EPSS1.08%MediumCVE-2025-60251unitree · b2_firmware +3 moreunitree b2_firmwareUnitree Go2, G1, H1, and B2 devices through 2025-09-20 accept any handshake secret with the unitree substring.EPSS0.20%MediumCVE-2025-60250unitree · b2_firmware +3 moreunitree b2_firmwareUnitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the df98b715d5c6ed2b25817b6f2554124a key and the 2841ae97419c2973296a0d4bdfe19a4f IV.EPSS0.19%HighCVE-2025-35027unitree · b2_firmware +3 moreUnitree Multiple Robotic Products Command InjectionMultiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script. All Unitree models use firmware derived from the same codebase (MIT Cheetah), and the two major forks are the G1 (humanoid) and Go2 (quadruped) branches.EPSS2.69%HighCVE-2026-27509unitree · go2_firmware +2 moreUnitree Go2 Missing DDS Authentication Enables Adjacent RCEUnitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pressed, the code executes as root and the binding persists across reboots.EPSS0.48%CriticalCVE-2026-27510unitree · go2_firmware +1 moreUnitree Go2 Mobile Program Tampering Enables Root RCEUnitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLite database (unitree_go2.db, table dog_programme) and transmits the programme_text content, including the pyCode field, to the robot. The robot's actuator_manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can tamper with the stored programme record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the application's community marketplace can result in arbitrary code execution on any robot that imports and runs it.EPSS0.46%