Unitree manufactures mobile robotic platforms, including its GO1 and GO2 quadruped robots and A1 humanoid systems, which expose a focused but strategically important attack surface in physical automation and remote-operated systems. Its vulnerability profile centers on authentication and authorization deficiencies—including missing authentication for critical functions, authentication bypass through spoofing, hidden functionality, and improper access controls—alongside OS command injection, reflecting common weaknesses in embedded systems that prioritize connectivity over perimeter security. Defenders deploying or operating these platforms should treat network isolation and credential management as primary mitigations; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Unitree over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-27510CRITICAL Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing | Feb 26, 2026 | 9.6 | 36 | NO | NO |
CVE-2026-27509HIGH Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actu | Feb 26, 2026 | 8.0 | 32 | NO | NO |
CVE-2025-35027HIGH Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string | Sep 26, 2025 | 7.3 | 29 | NO | NO |
CVE-2026-1442HIGH Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates m | Feb 27, 2026 | 7.8 | 28 | NO | NO |
CVE-2025-45466HIGH Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext. | Jul 25, 2025 | 8.8 | 25 | NO | NO |
CVE-2025-2894MEDIUM The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and a | Mar 28, 2025 | 6.6 | 24 | NO | NO |
CVE-2023-3104HIGH Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication. | Nov 22, 2023 | 7.5 | 22 | NO | NO |
CVE-2025-45467HIGH Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an insecure verification mechanism that sol | Jul 25, 2025 | 7.1 | 21 | NO | NO |
CVE-2023-3103MEDIUM Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera video stream. In addi | Nov 22, 2023 | 5.9 | 19 | NO | NO |
CVE-2022-2675MEDIUM Using off-the-shelf commodity hardware, the Unitree Go 1 robotics platform version H0.1.7 and H0.1.9 (using firmware version 0.1.35) can be powered down by an attacker within norma | Aug 5, 2022 | 6.5 | 17 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Unitree.
Media articles that mention a CVE ID that affects a product developed by Unitree — matched by CVE ID, not by vendor name.