CVE-2026-1442

Published Feb 27, 2026

Last updated a month ago

Overview

Description
Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models. This issue appears to affect all of Unitree’s current offerings as of February 26, 2026, and so should be considered a vulnerability in both the firmware generation and extraction processes. At the time of this release, there is no publicly-documented mechanism to subvert the update process and insert poisoned firmware packages without the equipment owner’s knowledge.
Source
cve@takeonme.org
NVD status
Analyzed
Products
go2_edu_standard_firmware, go2_air_firmware, go2_pro_firmware, go2_x_firmware, go1_air_firmware, go1_pro_firmware, go2_edu_plus_firmware

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

cve@takeonme.org
CWE-321

Social media

Hype score
Not currently trending

Configurations