CVE-2025-35027: Unitree Multiple Robotic Products Command Injection

Vulnerability summary

CVE-2025-35027 is a high (CVSS 7.3) OS Command Injection vulnerability in unitree b2_firmware. EPSS estimates a 2.69% chance of exploitation in the next 30 days, higher than 85.7% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 26-09-2025
   PublishedVulnerability first disclosed.
2. 07-10-2025
   Last modifiedVulnerability information updated.

Description

Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script. All Unitree models use firmware derived from the same codebase (MIT Cheetah), and the two major forks are the G1 (humanoid) and Go2 (quadruped) branches.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.