- Description
- Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script. All Unitree models use firmware derived from the same codebase (MIT Cheetah), and the two major forks are the G1 (humanoid) and Go2 (quadruped) branches.
- Source
- cve@takeonme.org
- NVD status
- Analyzed
- Products
- g1_firmware, go2_firmware, h1_firmware, b2_firmware
CVSS 3.1
- Type
- Secondary
- Base score
- 7.3
- Impact score
- 5.2
- Exploitability score
- 2.1
- Vector string
- CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Severity
- HIGH
- cve@takeonme.org
- CWE-78
- Hype score
- Not currently trending
Top 5 Trending CVEs: 1 - CVE-2026-25253 2 - CVE-2026-20841 3 - CVE-2025-35027 4 - CVE-2025-2894 5 - CVE-2025-33219 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W
@CVEShield
14 Feb 2026
71 Impressions
0 Retweets
0 Likes
1 Bookmark
0 Replies
0 Quotes
CVE-2025-35027 Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a mal… https://t.co/y9QI2TpQDu
@CVEnew
26 Sept 2025
225 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:unitree:g1_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "744A7CDD-60D1-4470-A1B6-D6E6C53E503A",
"versionEndIncluding": "1.4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:unitree:g1:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3DA4F27A-A866-4BA1-B478-A5AE95538D8A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:unitree:go2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9252B926-EB5E-417C-BCA3-EE5019DDDCBD",
"versionEndIncluding": "1.1.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:unitree:go2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "372BB5C0-26D8-4E99-A63E-F4FB2D0A50C2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:unitree:h1_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "49891C76-47D0-4421-B32A-8EBE95F8A7B0",
"versionEndIncluding": "1.4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:unitree:h1:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6B3BA8-EB04-43B6-9149-D88A3C59722B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:unitree:b2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "63F0F035-178A-4395-9268-8A4A4218AFD4",
"versionEndIncluding": "1.1.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:unitree:b2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1CFABD84-B19D-4056-BC3C-5EFAF6EF7719",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
]