Description (CNA)
Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pressed, the code executes as root and the binding persists across reboots.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| UnitreeRobotics / Unitree Go2 | affected 1.1.7 through 1.1.9; affected 1.1.11 |
CWE
CWE-306
References
- https://boschko.ca/unitree-go2-rce/
- https://shop.unitree.com/products/unitree-go2
- https://www.vulncheck.com/advisories/unitree-go2-missing-dds-authentication-enables-adjacent-rce
ADP enrichment
No English description supplied.
No references supplied.