What is the CVSS score of CVE-2026-27510?

CVE-2026-27510 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-27510?

Yes, a public proof-of-concept exploit is available for CVE-2026-27510. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-27510?

Within 24 hours: Inventory all Unitree Go2 robots and identify affected firmware versions; disconnect affected units from networks or disable remote program execution features if operationally feasible. Within 7 days: Contact Unitree for patch timeline; implement network segmentation to restrict robot communication to trusted administrative networks only. Within 30 days: Maintain compensating controls until patch availability; consider alternative robot platforms if timeline for remediation is unacceptable; document all affected assets and establish firmware update procedures for rapid deployment when patches release.

Go2 Firmware CVE-2026-27510

CRITICAL

Insufficient Verification of Data Authenticity (CWE-345)

2026-02-26 disclosure@vulncheck.com

RCE Python SQLi Android Go2 Firmware Unitree

9.6

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Compromise Android device locally
Exploit

Modify SQLite database programme_text
Execution

Send malicious pyCode to robot
Impact

Execute arbitrary Python as root

Vulnerability Assessment

Weakness	CWE CWE-345 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V15 - Secure Coding and Architecture Data authenticity verification
Exploitation Conditions	Local access to Android device running Unitree Go2 application (com.unitree.doggo2) with Unitree Go2 robot firmware versions 1.1.7–1.1.11. Attacker must modify unitree_go2.db SQLite database dog_programme table pyCode field before synchronization to robot.
Impact	CVSS 9.6. Physical safety concern — unauthorized control of a mobile robot could cause injury or property damage.
Exploit ScenarioDerived	Attacker sends commands to a Unitree Go2 robot through the unprotected communication channel, taking physical control of the robot's movement.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Remote control vulnerability in Unitree Go2 robot dog firmware 1.1.7-1.1.11. The companion Android app allows remote attackers to take control of the robot. PoC available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:56 CVSS 9.6

Remote takeover of Unitree Go2 robot dog.

RemediationAI

Update firmware. Do not use affected app version in public/untrusted environments.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-345 insufficient verification of data authenticity. The mobile app communicates with the Go2 robot without proper authentication of command sources.

Know when Go2 Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 12, 2026 - 20:03 vuln.today

Public exploit code

CVE Published

Feb 26, 2026 - 20:31 nvd

CRITICAL 9.6

DescriptionCVE.org

Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLite database (unitree_go2.db, table dog_programme) and transmits the programme_text content, including the pyCode field, to the robot. The robot's actuator_manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can tamper with the stored programme record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the application's community marketplace can result in arbitrary code execution on any robot that imports and runs it.

Executive ViewAI

Why It Matters

Organizations using Unitree Go2 robots with affected firmware versions (1.1.7-1.1.11) face critical remote code execution risk, allowing attackers to execute arbitrary commands on robotic systems without authentication. This vulnerability requires immediate action as public exploits exist and patches are unavailable, potentially compromising operational safety, data security, and physical assets.

Business Impact: Severe

Compensating Controls

Network segmentation: isolate affected robots on air-gapped or restricted VLAN; disable remote program upload feature in Go2 Android application if operational requirements permit; implement strict firewall rules allowing robot communication only from whitelisted administrative IP addresses; monitor for suspicious program uploads or robot command execution; disable the dog_programme execution feature entirely if not critical to operations; require manual code review and approval before any program execution; disable direct internet access for affected robots.

Threat Intelligence Overview

EPSS Score

0.1%

Top 76% exploitable

Exploit

POC

Public exploit code exists

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.