Unitree
8 CVEs across 32 Unitree products. Browse Unitree vulnerabilities, severities, and proof-of-concept exploits.
Unitree products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-1442 | High | 7.8 | 2026-02-27 | Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), t… |
CVE-2026-27510 | Critical | 9.6 | 2026-02-26 | Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code exec… |
CVE-2026-27509 | High | 8.0 | 2026-02-26 | Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt… |
CVE-2025-35027 | High | 7.3 | 2025-09-26 | Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By settin… |
CVE-2025-60251 | Medium | 5.0 | 2025-09-26 | Unitree Go2, G1, H1, and B2 devices through 2025-09-20 accept any handshake secret with the unitree substring. |
CVE-2025-60250 | Medium | 4.7 | 2025-09-26 | Unitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the df98b715d5c6ed2b25817b6f2554124a key and the 2841ae97419c2973296a0d… |
CVE-2025-60017 | High | 8.2 | 2025-09-26 | Unitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass parameter (within rest… |
CVE-2025-45466 | High | 8.8 | 2025-07-25 | Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext. |
CVE-2025-45467 | High | 7.1 | 2025-07-25 | Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an insecure verificati… |
CVE-2025-2894 | Medium | 6.6 | 2025-03-28 | The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable th… |
CVE-2023-3104 | Medium | 5.7 | 2023-11-22 | Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of auth… |
CVE-2023-3103 | High | 8.0 | 2023-11-22 | Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera… |
CVE-2022-2675 | Medium | 6.5 | 2022-08-05 | Using off-the-shelf commodity hardware, the Unitree Go 1 robotics platform version H0.1.7 and H0.1.9 (using firmware version 0.1.35) can be powered down by an… |