6.6

CVE-2025-2894

Medienbericht
Exploit

Unitree Go1 Robot Dog Backdoor Control Channel

The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control over the affected robotic device using the CloudSail remote access service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Unitree ≫ Go1 Firmware Version-
   Unitree ≫ Go1 Version-
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.7% 0.485
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cve@takeonme.org 6.6 0.7 5.9
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-912 Hidden Functionality

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/Unitree_report.pdf
Third Party Advisory
Exploit
https://github.com/unitreerobotics/unitree_ros/issues/120
Third Party Advisory
Issue Tracking
https://takeonme.org/cves/cve-2025-2894/
Third Party Advisory
Exploit
Mitigation
https://x.com/d0tslash/status/1730989109332607208
Press/Media Coverage
https://www.axios.com/2025/04/01/threat-spotlight-backdoor-in-chinese-robots-future-of-cybersecurity
Press/Media Coverage