EUVD-2026-49180
GHSA-3q83-gf9g-9qxm
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (INCIBE) · only source for this CVE.
CVSS VectorVendor: INCIBE
Lifecycle Timeline
2DescriptionCVE.org
An access control vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active, legitimate session. This allows the attacker to bypass control restrictions, intercept sensitive information (such as real-time video), and partially interact with the system unnoticed and without disconnecting the legitimate user, compromising confidentiality and operational security.
AnalysisAI
Ghost Robotics Vision 60 mobile app (APK v5.5.0) fails to enforce single-client sessions, allowing an unauthenticated attacker with a modified app on the adjacent network to connect to the robot while a legitimate operator is active. The attacker can intercept real-time video and send commands without alerting the legitimate user, compromising confidentiality and operational control. No active exploitation or public exploit code has been identified; a vendor patch is available.
Missing authentication in Ghost Robotics' Vision 60 quadruped robot - specifically in the mobile app (APK v5.5.0) exposi
Man-in-the-middle attack against Ghost Robotics Vision 60 robot firmware v5.5.0 allows local network attackers to interc
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today