CVE-2025-35027
Full vulnerability record from the local CVENow database.
Description
Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script. All Unitree models use firmware derived from the same codebase (MIT Cheetah), and the two major forks are the G1 (humanoid) and Go2 (quadruped) branches.
Severity
HIGH
CVSS score
7.3
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2025-09-26 07:15:41.413000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-35027",
"sourceIdentifier": "[email protected]",
"published": "2025-09-26T07:15:41.413",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script. All Unitree models use firmware derived from the same codebase (MIT Cheetah), and the two major forks are the G1 (humanoid) and Go2 (quadruped) branches."
},
{
"lang": "es",
"value": "Múltiples productos robóticos de Unitree que comparten un firmware común, incluyendo los dispositivos Go2, G1, H1 y B2, contienen una vulnerabilidad de inyección de comandos. Al establecer una cadena maliciosa al configurar el WiFi integrado a través de un módulo BLE de un robot afectado, y luego al activar un reinicio del servicio WiFi, un atacante puede finalmente activar comandos para que se ejecuten como root a través del script de shell wpa_supplicant_restart.sh. Todos los modelos de Unitree usan firmware derivado de la misma base de código (MIT Cheetah), y las dos bifurcaciones principales son las ramas G1 (humanoide) y Go2 (cuadrúpedo)."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Unitree",
"product": "Go2",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "1.1.8",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Unitree",
"product": "G1",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "1.4.4",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.1,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-30T18:04:59.805441Z",
"id": "CVE-2025-35027",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:unitree:g1_firmware:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.4.4",
"matchCriteriaId": "744A7CDD-60D1-4470-A1B6-D6E6C53E503A"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:unitree:g1:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3DA4F27A-A866-4BA1-B478-A5AE95538D8A"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:unitree:go2_firmware:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.1.8",
"matchCriteriaId": "9252B926-EB5E-417C-BCA3-EE5019DDDCBD"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:unitree:go2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "372BB5C0-26D8-4E99-A63E-F4FB2D0A50C2"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:unitree:h1_firmware:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.4.4",
"matchCriteriaId": "49891C76-47D0-4421-B32A-8EBE95F8A7B0"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:unitree:h1:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6B3BA8-EB04-43B6-9149-D88A3C59722B"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:unitree:b2_firmware:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.1.8",
"matchCriteriaId": "63F0F035-178A-4395-9268-8A4A4218AFD4"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:unitree:b2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1CFABD84-B19D-4056-BC3C-5EFAF6EF7719"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/Bin4ry/UniPwn",
"source": "[email protected]",
"tags": [
"Exploit",
"Technical Description"
]
},
{
"url": "https://spectrum.ieee.org/unitree-robot-exploit",
"source": "[email protected]",
"tags": [
"Press/Media Coverage"
]
},
{
"url": "https://takeonme.org/cves/cve-2025-35027",
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://www.cve.org/cverecord?id=CVE-2025-60017",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.cve.org/cverecord?id=CVE-2025-60250",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://x.com/committeeonccp/status/1971250635548033311",
"source": "[email protected]",
"tags": [
"Press/Media Coverage"
]
},
{
"url": "https://github.com/Bin4ry/UniPwn",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Technical Description"
]
}
]
}