CVE-2025-2894

Concrete details exist for CVE-2025-2894 in connected docs: Unitree Go1 family robots (Go2, G1, H1, B2) expose a BLE Wi‑Fi configuration interface with a hardcoded AES-CFB128 key and IV, enabling an authentication bypass (

CVE-2025-45466

The Unitree Go1 bionic robot (firmware versions ≤ Go1_2022_05_11 ) is vulnerable to Incorrect Access Control due to hardcoded plaintext authentication credentials within the firmware's /run.sh script. An attacker can extract these credentials to gain unauthorized root access via SSH or SCP over W...

CVE-2025-45467

The Unitree Go1 robotic dog (firmware versions ≤ Go1_2022_05_11 ) is vulnerable to Insecure Permissions due to a flawed firmware update mechanism. The system relies solely on MD5 checksums for integrity validation over Wi-Fi or Ethernet without employing digital signatures or authentication. An a...