CVE-2026-115996

A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chatgo. Performing a manipulation results in improper certificate validation. The attack may be initiated...

CVE-2026-115995

A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function setvolume of the file gptthread.py of the component chatgo. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely...

CVE-2026-115996

A vulnerability exists in the Unitree Robotics Unitree Go2 (versions up to 1.1.13/1.1.14.1/1.1.15.1) within the chat_go component. The root cause is located in the WebSocketClient.connect function of the websocket.py file, which performs improper certificate validation (CWE-295). An attacker may ...

CVE-2026-115996 Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation

A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chatgo. Performing a manipulation results in improper certificate validation. The attack may be initiated...

CVE-2026-115995

A critical OS command injection vulnerability exists in the Unitree Robotics Unitree Go2 (versions up to 1.1.11.4 ) within the chat_go component. The flaw is located in the set_volume function of the gpt_thread.py file, where improper neutralization of the Value argument allows an attacker to exe...

PT-2026-122668

Name of the Vulnerable Software and Affected Versions Unitree Robotics Unitree Go2 versions prior to 1.1.11.5 Description An OS command injection flaw exists in the chat go component. A remote attacker can execute arbitrary operating system commands by manipulating the Value argument within the s...

CVE-2025-35027

CVE-2025-35027 affects Unitree Go2, G1, H1, and B2 robotic devices sharing a common firmware (MIT Cheetah). It enables command injection by supplying a malicious string during BLE-configured WiFi setup and triggering a WiFi service restart, allowing commands to run as root via the wpa_supplicant_...

CVE-2023-3104 Missing Authentication for Critical Function in Unitree Robotics A1

Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication...

CVE-2023-3103 Authentication Bypass by Spoofing in Unitree Robotics A1

Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle MITM attack on the robot's camera video stream. In addition, if a MITM attack is carried out, it is possible to consume the robot's resources, which could lead to a...

Unitree Robotics A1 Security Breach

Unitree Robotics A1 is a quadrupedal robot from Chinese company Unitree Robotics. A security vulnerability exists in Unitree Robotics A1 version 1.16, which stems from a lack of authentication and allows a local attacker to use a web server to view through a webcam...