Auth bypass in Unitree Go 1
CVE-2022-2675
Using off-the-shelf commodity hardware, the Unitree Go 1 robotics platform version H0.1.7 and H0.1.9 (using firmware version 0.1.35) can be powered down by an attacker within normal RF range without authentication. Other versions may be affected, such as the A1.
EPSS: 0.005 (37.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Unitree Go 1 — versions 0.1.35
- Unitree Go_1 — versions h0.1.7, h0.1.9
- Unitree Go_1_firmware
Weakness classification (CWE)
References
- cve@rapid7.com (Third Party Advisory, x_refsource_MISC)
- cve@rapid7.com (Product, Third Party Advisory, x_refsource_MISC)
- cve@rapid7.com (Product, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-2675?
- CVE-2022-2675 is a medium-severity vulnerability in Unitree Go 1, classified under Improper Authorization. CVSS score: 6.5/10. Published 2022-08-05.
- How severe is CVE-2022-2675?
- Medium severity. CVSS v3 base score is 6.5 out of 10.