Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Ghost Robotics Vision 60 Robot App Unsecured by Wi-Fi

CVE-2026-12989 · published 3 months ago
Summary

The mobile app for Ghost Robotics' Vision 60 robot has a security flaw that allows unauthorized access to the robot's controls and camera feeds when connected to its internal Wi-Fi network. This means that an attacker could potentially take control of the robot or view its surroundings, compromising the robot's security and the safety of its users. To protect the robot, update the mobile app to the latest version and ensure that the internal Wi-Fi network is secure.

Original advisory text
A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted ...
A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization mechanisms, the attacker can view real-time camera feeds, control the robot’s movements, manage sensors (GPS, RTK, SAM, LIDAR), and execute critical operational commands (Play, Pause, Stop, E-Stop). Successful exploitation completely compromises the confidentiality, integrity, and physical security of the system.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published27 Jul 2026
Updated31 Oct 2026
First seen27 Jul 2026
Sources
CVE-2026-12989 · NVD
Track software like this
Free during beta