CVE-2025-35027

Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script. All Unitree models use firmware derived from the same codebase (MIT Cheetah), and the two major forks are the G1 (humanoid) and Go2 (quadruped) branches.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Bin4ry/UniPwn	Exploit Technical Description
https://spectrum.ieee.org/unitree-robot-exploit	Press/Media Coverage
https://takeonme.org/cves/cve-2025-35027	Exploit Third Party Advisory
https://www.cve.org/cverecord?id=CVE-2025-60017	Third Party Advisory
https://www.cve.org/cverecord?id=CVE-2025-60250	Third Party Advisory
https://x.com/committeeonccp/status/1971250635548033311	Press/Media Coverage
https://github.com/Bin4ry/UniPwn	Exploit Technical Description

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:unitree:g1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:unitree:g1:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:unitree:go2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:unitree:go2:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:unitree:h1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:unitree:h1:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:unitree:b2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:unitree:b2:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-09-26 07:15

Updated : 2026-01-12 16:54

NVD link : CVE-2025-35027

Mitre link : CVE-2025-35027

CVE.ORG link : CVE-2025-35027

JSON object : View

Products Affected

unitree

g1
go2_firmware
b2
h1
g1_firmware
go2
h1_firmware
b2_firmware

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-35027", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@takeonme.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.1}]}, "published": "2025-09-26T07:15:41.413", "references": [{"url": "https://github.com/Bin4ry/UniPwn", "tags": ["Exploit", "Technical Description"], "source": "cve@takeonme.org"}, {"url": "https://spectrum.ieee.org/unitree-robot-exploit", "tags": ["Press/Media Coverage"], "source": "cve@takeonme.org"}, {"url": "https://takeonme.org/cves/cve-2025-35027", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@takeonme.org"}, {"url": "https://www.cve.org/cverecord?id=CVE-2025-60017", "tags": ["Third Party Advisory"], "source": "cve@takeonme.org"}, {"url": "https://www.cve.org/cverecord?id=CVE-2025-60250", "tags": ["Third Party Advisory"], "source": "cve@takeonme.org"}, {"url": "https://x.com/committeeonccp/status/1971250635548033311", "tags": ["Press/Media Coverage"], "source": "cve@takeonme.org"}, {"url": "https://github.com/Bin4ry/UniPwn", "tags": ["Exploit", "Technical Description"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@takeonme.org", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script.\u00a0All Unitree models use firmware derived from the same codebase (MIT Cheetah), and the two major forks are the G1 (humanoid) and Go2 (quadruped) branches."}], "lastModified": "2026-01-12T16:54:07.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:unitree:g1_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "744A7CDD-60D1-4470-A1B6-D6E6C53E503A", "versionEndIncluding": "1.4.4"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:unitree:g1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3DA4F27A-A866-4BA1-B478-A5AE95538D8A"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:unitree:go2_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9252B926-EB5E-417C-BCA3-EE5019DDDCBD", "versionEndIncluding": "1.1.8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:unitree:go2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "372BB5C0-26D8-4E99-A63E-F4FB2D0A50C2"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:unitree:h1_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49891C76-47D0-4421-B32A-8EBE95F8A7B0", "versionEndIncluding": "1.4.4"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:unitree:h1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FA6B3BA8-EB04-43B6-9149-D88A3C59722B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:unitree:b2_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63F0F035-178A-4395-9268-8A4A4218AFD4", "versionEndIncluding": "1.1.8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:unitree:b2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1CFABD84-B19D-4056-BC3C-5EFAF6EF7719"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@takeonme.org"}