Vision 60 CVE-2026-12989

Patch available per vendor advisory: Ghost Robotics has released a fix, and affected operators should obtain the corrected build and updated mobile application through the vendor and apply it to every Vision 60 in the fleet, following the guidance in the INCIBE advisory (https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ghost-robotics-vision-60); an exact patched version number is not stated in the available data, so confirm the fixed release directly with Ghost Robotics. Until the update is applied, the decisive compensating control is network isolation, since adjacency to the robot's internal Wi-Fi is the sole precondition for exploitation: replace the default Wi-Fi credentials with a long, unique WPA2/WPA3 passphrase, disable any open or guest SSID broadcast by the robot, and rotate keys whenever a device leaves the team, accepting that key rotation briefly interrupts operator connectivity. Where operationally possible, bind the robot's access point to a dedicated, non-bridged VLAN with client isolation enabled so that a compromised laptop or phone cannot reach the HTTP API, at the cost of losing peer-to-peer tooling on that segment. Because the interface has no authentication at all, there is no credential or token to harden; application-layer controls such as reverse proxies or WAFs are of limited value on a link-local embedded stack, so physical and RF range control (operating indoors, shielded enclosures, RF monitoring for rogue associations) should be treated as the residual risk mitigation. Finally, monitor the robot's Wi-Fi association logs and HTTP request logs for unexpected clients and unsolicited E-Stop, movement or sensor-reconfiguration commands, which are the clearest indicators of exploitation of this issue.