CVE-2025-2894

MEDIUM EPSS 48.7%
Published Mar 28, 20251y ago · Modified Jun 17, 20261w ago
6.6 CVSS 3.1
Medium
Find Similar
Published Mar 28, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control over the affected robotic device using the CloudSail remote access service.

CVSS Details

Base Score
6.6
Exploitability
0.7
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity High
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
48.7% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-912

Affected Products 2

VendorProductVersionRange
unitreego1_firmware*any
unitreego1*any

References 5

  • github.com https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/Unitree_report.pdf
    ExploitThird Party Advisory
  • github.com https://github.com/unitreerobotics/unitree_ros/issues/120
    Issue TrackingThird Party Advisory
  • takeonme.org https://takeonme.org/cves/cve-2025-2894/
    ExploitMitigationThird Party Advisory
  • axios.com https://www.axios.com/2025/04/01/threat-spotlight-backdoor-in-chinese-robots-future-of-cybersecurity
    Press/Media Coverage
  • x.com https://x.com/d0tslash/status/1730989109332607208
    Press/Media Coverage

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.