CVE-2025-35027 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting…
High CVSS: 7.3

CVE-2025-35027

Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script. All Unitree models use firmware derived from the same codebase (MIT Cheetah), and the two major forks are the G1 (humanoid) and Go2 (quadruped) branches.
Vendor
Unitree
Product
G1 Firmware
CWE
CWE-78
Yayın Tarihi
2025-09-26 07:15:41
Güncelleme
2026-01-12 16:54:07
Source Identifier
cve@takeonme.org
KEV Date Added
-

Kategoriler

CWE-78 G1 Firmware HIGH Unitree 2025

Referanslar

https://github.com/Bin4ry/UniPwn https://spectrum.ieee.org/unitree-robot-exploit https://takeonme.org/cves/cve-2025-35027 https://www.cve.org/cverecord?id=CVE-2025-60017 https://www.cve.org/cverecord?id=CVE-2025-60250 https://x.com/committeeonccp/status/1971250635548033311 https://github.com/Bin4ry/UniPwn