What is the CVSS score of CVE-2026-27510?

CVE-2026-27510 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2026-27510?

Organizations using Unitree Go2 robots with affected firmware versions (1.1.7-1.1.11) face critical remote code execution risk, allowing attackers to execute arbitrary commands on robotic systems…

Is there a public PoC exploit available for CVE-2026-27510?

Yes, a public proof-of-concept exploit is available for CVE-2026-27510. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-27510?

Within 24 hours: Inventory all Unitree Go2 robots and identify affected firmware versions; disconnect affected units from networks or disable remote program execution features if operationally feasible. Within 7 days: Contact Unitree for patch timeline; implement network segmentation to restrict robot communication to trusted administrative networks only. Within 30 days: Maintain compensating controls until patch availability; consider alternative robot platforms if timeline for remediation is unacceptable; document all affected assets and establish firmware update procedures for rapid deployment when patches release.

Python CVE-2026-27510

CRITICAL

Insufficient Verification of Data Authenticity (CWE-345)

2026-02-26 disclosure@vulncheck.com

RCE Python SQLi Android Go2 Firmware Unitree

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

PoC Detected

Mar 12, 2026 - 20:03 vuln.today

Public exploit code

CVE Published

Feb 26, 2026 - 20:31 nvd

CRITICAL 9.6

DescriptionCVE.org

Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLite database (unitree_go2.db, table dog_programme) and transmits the programme_text content, including the pyCode field, to the robot. The robot's actuator_manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can tamper with the stored programme record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the application's community marketplace can result in arbitrary code execution on any robot that imports and runs it.

AnalysisAI

Remote control vulnerability in Unitree Go2 robot dog firmware 1.1.7-1.1.11. The companion Android app allows remote attackers to take control of the robot. PoC available.

Technical ContextAI

CWE-345 insufficient verification of data authenticity. The mobile app communicates with the Go2 robot without proper authentication of command sources.