CVE-2025-35027

🗓️ 26 Sep 2025 06:53:49Reported by AHAType

Unitree robotics suffer command injection via BLE WiFi config, enabling root commands via wpa_supplicant script.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2025-35025	31 Dec 200023:00	–	circl
Circl	CVE-2025-35027	31 Dec 200023:00	–	circl
CNNVD	Unitree多款产品安全漏洞	26 Sep 202500:00	–	cnnvd
Cvelist	CVE-2025-35027 Unitree Multiple Robotic Products Command Injection	26 Sep 202506:53	–	cvelist
EUVD	EUVD-2025-31217	3 Oct 202520:07	–	euvd
NVD	CVE-2025-35027	26 Sep 202507:15	–	nvd
OSV	CVE-2025-35027	26 Sep 202507:15	–	osv
Positive Technologies	PT-2025-39519	26 Sep 202500:00	–	ptsecurity
Vulnrichment	CVE-2025-35027 Unitree Multiple Robotic Products Command Injection	26 Sep 202506:53	–	vulnrichment

NVD

Node

unitree g1_firmwareRange≤1.4.4

AND

unitree g1Match-

Node

unitree go2_firmwareRange≤1.1.8

AND

unitree go2Match-

Node

unitree h1_firmwareRange≤1.4.4

AND

unitree h1Match-

Node

unitree b2_firmwareRange≤1.1.8

AND

unitree b2Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "Go2",
    "vendor": "Unitree",
    "versions": [
      {
        "lessThanOrEqual": "1.1.8",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "G1",
    "vendor": "Unitree",
    "versions": [
      {
        "lessThanOrEqual": "1.4.4",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
cve	www.cve.org/cverecord
github	www.github.com/Bin4ry/UniPwn
spectrum	www.spectrum.ieee.org/unitree-robot-exploit
x	www.x.com/committeeonccp/status/1971250635548033311
cve	www.cve.org/cverecord
takeonme	www.takeonme.org/cves/cve-2025-35027

17 Jun 2026 09:14Current

7High risk

Vulners AI Score7

CVSS 3.17.3

EPSS0.02279

SSVC

CWE-78