Unitree Robotics vulnerabilities
We track 4 vulnerabilities in Unitree Robotics products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 24, 2026.
Latest Unitree Robotics vulnerabilities
- 9.6 Critical severity
Unitree Go2: Improper Neutralization of Special Elements used in a Command
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection
- 7.5 High severity
G1 EDU: Missing Authentication for Critical Functionality
Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unq
- 8.8 High severity
G1 EDU: Improper Limitation of a Pathname to a Restricted Directory
Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port
- 7.5 High severity
A1: Missing Authentication for Critical Functionality
Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication.