Auth bypass in Unitree A1
CVE-2023-3104
Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication.
Vulnerability class: Broken Authentication
EPSS: 0.005 (42.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Unitree A1 — versions 1.16
- Unitree A1_firmware
- Unitree Robotics A1 — versions 1.16
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve-coordination@incibe.es (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-3104?
- CVE-2023-3104 is a medium-severity vulnerability in Unitree A1, classified under Missing Authentication for Critical Function. CVSS score: 5.7/10. Published 2023-11-22.
- How severe is CVE-2023-3104?
- Medium severity. CVSS v3 base score is 5.7 out of 10.
- Is CVE-2023-3104 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.