Unitree Robotics vulnerabilities

6 vulnerabilities

Known vulnerabilities in Unitree Robotics products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.

Products

3
10CriticalCVE-2026-115995unitree robotics · unitree go2Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injectionA security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."6.3MediumCVE-2026-115996unitree robotics · unitree go2Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validationA vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."8.8HighCVE-2026-76639unitree robotics · g1 eduUnitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path TraversalUnitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, plant a malicious payload in its script execution directory via path traversal, and trigger execution of that payload as uid 0 through the bashrunner shell subprocess.EPSS0.67%7.7HighCVE-2026-76640unitree robotics · g1 eduUnitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning StackUnitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi provisioning script and a buffer overflow in the SSID chunk accumulator. Attackers can send crafted BLE writes to overflow a fixed BSS buffer across BLE connections, corrupting an adjacent mainloop function pointer dispatch entry that is subsequently invoked by the cleanup path passing attacker-controlled data to system() as uid 0.EPSS0.34%7.5HighCVE-2023-3104unitree robotics · a1 +1 moreMissing Authentication for Critical Function in Unitree Robotics A1Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication.EPSS0.55%8HighCVE-2023-3103unitree robotics · a1 +1 moreAuthentication Bypass by Spoofing in Unitree Robotics A1Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera video stream. In addition, if a MITM attack is carried out, it is possible to consume the robot's resources, which could lead to a denial-of-service (DOS) condition.EPSS0.57%