AND
     OR
          *cpe:2.3:o:unitree:b2_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.1.8
     OR
          cpe:2.3:h:unitree:b2:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:unitree:g1_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.4.4
     OR
          cpe:2.3:h:unitree:g1:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:unitree:go2_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.1.8
     OR
          cpe:2.3:h:unitree:go2:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:unitree:h1_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.4.4
     OR
          cpe:2.3:h:unitree:h1:-:*:*:*:*:*:*:*

Austin Hackers Anonymous: https://github.com/Bin4ry/UniPwn Types: Exploit, Technical Description

Austin Hackers Anonymous: https://spectrum.ieee.org/unitree-robot-exploit Types: Press/Media Coverage

Austin Hackers Anonymous: https://takeonme.org/cves/cve-2025-35027 Types: Exploit, Third Party Advisory

Austin Hackers Anonymous: https://www.cve.org/cverecord?id=CVE-2025-60017 Types: Third Party Advisory

Austin Hackers Anonymous: https://www.cve.org/cverecord?id=CVE-2025-60250 Types: Third Party Advisory

Austin Hackers Anonymous: https://x.com/committeeonccp/status/1971250635548033311 Types: Press/Media Coverage

CISA-ADP: https://github.com/Bin4ry/UniPwn Types: Exploit, Technical Description

https://github.com/Bin4ry/UniPwn

Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script.

Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script. All Unitree models use firmware derived from the same codebase (MIT Cheetah), and the two major forks are the G1 (humanoid) and Go2 (quadruped) branches.

https://takeonme.org/cves/cve-2025-35027

https://https://takeonme.org/cves/cve-2025-35027

Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script.

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE-78

https://github.com/Bin4ry/UniPwn

https://https://takeonme.org/cves/cve-2025-35027

https://spectrum.ieee.org/unitree-robot-exploit

https://www.cve.org/cverecord?id=CVE-2025-60017

https://www.cve.org/cverecord?id=CVE-2025-60250

https://x.com/committeeonccp/status/1971250635548033311