CVE-2025-10772: huggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authentication
Vulnerability summary
CVE-2025-10772 is a medium (CVSS 6.3) Improper Authentication vulnerability in huggingface lerobot. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 21.6% of scored vulnerabilities.
Not severe (CVSS 5.3, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 21-09-2025PublishedVulnerability first disclosed.
- 22-09-2025Last modifiedVulnerability information updated.
Description
A vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robot_devices/robots/lekiwi_remote.py of the component ZeroMQ Socket Handler. The manipulation leads to missing authentication. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS metrics
7 scores · 2 sources · 4 versions- NVDNIST5.3MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST6.3MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- NVDNIST5.8MediumAV:A/AC:L/Au:N/C:P/I:P/A:P
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.29% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-306Missing Authentication for Critical FunctionalityThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Huggingface1 product
- lerobot0.3.0 | 0.3.1 | 0.3.2 | 0.3.3
1 vendor · 1 product
References
3 links- vuldb.com?id.325128VDB Entry
- vuldb.com?submit.649798Third Party Advisory