CVE-2025-35027
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-26

Last updated on: 2025-09-30

Assigner: Austin Hackers Anonymous

Description
Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script.Β All Unitree models use firmware derived from the same codebase (MIT Cheetah), and the two major forks are the G1 (humanoid) and Go2 (quadruped) branches.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-26
Last Modified
2025-09-30
Generated
2026-05-07
AI Q&A
2025-09-26
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
unitree b2 *
unitree g1 *
unitree h1 *
unitree go2 *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a command injection flaw found in multiple Unitree robotic products that share common firmware. An attacker can exploit it by setting a malicious string during the configuration of the on-board WiFi via a BLE module. When the WiFi service is restarted, the malicious input causes commands to be executed with root privileges through the wpa_supplicant_restart.sh script.


How can this vulnerability impact me? :

The vulnerability allows an attacker with access to the BLE module to execute arbitrary commands as root on the affected robot. This can lead to unauthorized control over the device, potentially compromising its operation, stealing sensitive data, or disrupting its functionality.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart