Unitree vulnerabilities
We track 7 vulnerabilities in Unitree products across 19 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on February 27, 2026.
Latest Unitree vulnerabilities
- 7.8 High severity
UPK: Use of Hard-coded Cryptographic Key
Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, su
- 8.8 High severity
Unitree Go2: Insufficient Verification of Data Authenticity
Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android appl
- 8.0 High severity
Unitree Go2: Missing Authentication for Critical Functionality
Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated
- 7.3 High severity
Go2: Improper Neutralization of Special Elements used in an OS Command
Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then t
- 8.2 High severity
Go2: Improper Neutralization of Special Elements used in an OS Command
Unitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass parameter (within restart_wifi_ap and restart_wifi_sta).
- 7.1 High severity
Go1 Firmware: Incorrect Default Permissions
Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an insecure verification mechanism that solely relies on MD5 checksums for firmware integrity validation.
- 7.5 High severity
A1: Missing Authentication for Critical Functionality
Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication.