CVE-2026-27509 Unitree Go2 Missing DDS Authentication Enables Adjacent RCE

Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 EDU do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programmingactuator/request handled by actuatormanager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publi...

CVE-2026-27509: Missing Authentication for Critical Function

Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 EDU do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programmingactuator/request handled by actuatormanager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publi...

Unitree Go2 访问控制错误漏洞

The Unitree Go2 is a robotic dog developed by the Chinese company Unitree. Versions 1.1.7 to 1.1.9, as well as version 1.1.11 of Unitree Go2, have vulnerabilities related to access control. These vulnerabilities stem from the lack of DDS authentication or authorization for the Eclipse CycloneDDS...

EUVD-2021-24893

Malware in sbrugna...

EUVD-2021-24895

Malware in sbrugna...

CVE-2021-38441

Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser...

CVE-2021-38443

Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser...

Linux Distros Unpatched Vulnerability : CVE-2021-38441

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML...

Linux Distros Unpatched Vulnerability : CVE-2021-38443

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser...

cyclonedds:fuzz_sample_deser: Crash in stream_normalize_adr

Detailed Report: https://oss-fuzz.com/testcase?key=5306173018931200 Project: cyclonedds Fuzzing Engine: honggfuzz Fuzz Target: fuzzsampledeser Job Type: honggfuzzasancyclonedds Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7ffff6d00000 Crash State: streamnormalizeadr...

cyclonedds:fuzz_security_deser: Heap-buffer-overflow in DDS_Security_Deserialize_ParticipantBuiltinTopicData

Project: https://github.com/eclipse-cyclonedds/cyclonedds.git Detailed Report: https://oss-fuzz.com/testcase?key=5398850366930944 Project: cyclonedds Fuzzing Engine: honggfuzz Fuzz Target: fuzzsecuritydeser Job Type: honggfuzzasancyclonedds Platform Id: linux Crash Type: Heap-buffer-overflow READ...

cyclonedds:fuzz_type_object: Heap-buffer-overflow in xt_valid_enum_values

Project: https://github.com/eclipse-cyclonedds/cyclonedds.git Detailed Report: https://oss-fuzz.com/testcase?key=4530077902438400 Project: cyclonedds Fuzzing Engine: libFuzzer Fuzz Target: fuzztypeobject Job Type: libfuzzerasancyclonedds Platform Id: linux Crash Type: Heap-buffer-overflow READ 4...

PT-2023-35750 · Git +1 · Cyclonedds

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read error. Technical details about the crash include the functions add complete typeobj, ddsi xt type add...

cyclonedds:fuzz_type_object: Heap-use-after-free in ddsi_type_unref_impl_locked

Project: https://github.com/eclipse-cyclonedds/cyclonedds.git Detailed Report: https://oss-fuzz.com/testcase?key=5523793927077888 Project: cyclonedds Fuzzing Engine: afl Fuzz Target: fuzztypeobject Job Type: aflasancyclonedds Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address...

cyclonedds:fuzz_type_object: Crash in ddsi_type_add_typeobj

Project: https://github.com/eclipse-cyclonedds/cyclonedds.git Detailed Report: https://oss-fuzz.com/testcase?key=5539544822054912 Project: cyclonedds Fuzzing Engine: libFuzzer Fuzz Target: fuzztypeobject Job Type: libfuzzerubsancyclonedds Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address...

cyclonedds:fuzz_config_init: Segv on unknown address in ddsi_config_init

Project: https://github.com/eclipse-cyclonedds/cyclonedds.git Detailed Report: https://oss-fuzz.com/testcase?key=5320678181568512 Project: cyclonedds Fuzzing Engine: libFuzzer Fuzz Target: fuzzconfiginit Job Type: libfuzzerasancyclonedds Platform Id: linux Crash Type: Segv on unknown address Cras...

CVE-2021-38443

Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser...

CVE-2021-38441

Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser...

CVE-2021-38443

Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser...

CVE-2021-38441

Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser...