Unitree Go2 CVE-2026-115995

Exploitation requires reaching the Go2's chat_go component - the GPT/voice-chat feature - and invoking the set_volume function in gpt_thread.py with a crafted Value argument that embeds shell metacharacters (CWE-78). The CVSS vector specifies PR:N (no authentication) and UI:P (passive user interaction required), so some user-side interaction is a limiting factor and exploitation is not purely autonomous. The practical limiter is reachability of the chat_go service: the description states the attack can be launched remotely, but the exact network exposure (internet-facing vs. local network/companion-app reachable) is not described in the available sources, so defenders should confirm whether the service is reachable from untrusted networks. Affected versions are Unitree Go2 up to and including 1.1.11.4; upgrading to 1.1.11.5 is the vendor-stated complete fix.

This is a genuine high-priority issue rather than a CVSS-inflated one, though several decision signals are missing. The vendor (Unitree) confirmed the flaw early, tying it to internal ticket #474, and a patch (firmware 1.1.11.5) is available - both strong confirmations. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) describes a network-reachable, low-complexity, unauthenticated OS command injection (CWE-78) requiring only passive user interaction, with High impact to confidentiality, integrity and availability on both the vulnerable and subsequent systems (score 9.4). The vuln.today decision label is act_now, reinforcing urgency. However, this is NOT CISA KEV-listed and no EPSS exploitation-probability score was supplied, so there is no evidence of active or widespread exploitation - the urgency here derives from the decision label, vendor confirmation and the severity of the flaw class, not from observed in-the-wild activity. The provided CVSS 4.0 vector marks AV:N, but for a quadruped robot the 'remote' reach likely means the attacker must be on the same network or able to reach the robot's chat_go service - verify network exposure in your deployment, as this materially changes real-world risk. EPSS and KEV absence should be read as 'not yet assessed/observed,' not as low risk.

An attacker who can reach the Go2's chat_go GPT service submits a crafted Value to the set_volume function in gpt_thread.py; because the argument is passed to an OS command without sanitization, injected shell metacharacters execute arbitrary commands on the robot. The CVSS vector indicates low attack complexity, no authentication, and passive user interaction (UI:P), so interaction is minimal. No verified working exploit code was identified in the provided sources, though VulDB tracks the submission and threat-intel entry.