Unitree Go2 firmware: Unauthenticated code execution via DDS protocol

Summary

The Unitree Go2 robot's firmware has a security flaw that allows an attacker on the same network to inject code into the robot, which can run with superuser privileges. This allows the attacker to take control of the robot. To fix this, update the firmware to a version that has the security patch.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
unitree	go2_firmware	> 1.1.7 , <= 1.1.9	–
unitree	go2_edu_firmware	1.1.11	–

Original title

Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handl...

Original description

Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pressed, the code executes as root and the binding persists across reboots.

nvd CVSS3.1 8.0

nvd CVSS4.0 8.5

Vulnerability type

CWE-306 Missing Authentication for Critical Function