Skip to main content

Vision 60 EUVDEUVD-2026-49181

| CVE-2026-12991 HIGH
Channel Accessible by Non-Endpoint (CWE-300)
2026-07-27 INCIBE GHSA-55c3-q2mc-rv5w
Authentication Bypass Vision 60
8.7
CVSS 4.0 · Vendor: INCIBE
Share

Severity by source

Vendor (INCIBE) PRIMARY
8.7 HIGH
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (INCIBE) · only source for this CVE.

CVSS VectorVendor: INCIBE

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 27, 2026 - 13:22 vuln.today
CVE Published
Jul 27, 2026 - 11:44 cve.org
HIGH 8.7

DescriptionCVE.org

The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot (APK v5.5.0) exposes the system to man-in-the-middle attacks. An attacker located on the local network can use ARP spoofing and selective traffic blocking techniques to intercept and manipulate packets between the legitimate operator and the robot. This allows the attacker to disconnect the original controller, establish unauthorized communications, and prevent the operator from regaining control of the device, seriously compromising the confidentiality, integrity, and availability (CIA) of operations.

AnalysisAI

Man-in-the-middle attack against Ghost Robotics Vision 60 robot firmware v5.5.0 allows local network attackers to intercept and manipulate communications, disconnect legitimate operators, and take unauthorized control of the quadruped robot, completely compromising confidentiality, integrity, and availability of operations. No active exploitation has been reported in CISA KEV, and no public exploit code was identified at time of analysis.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Vision 60

View all
CVE-2026-12989 HIGH
8.7 Jul 27

We need to produce a JSON output for CVE-2026-12989 based on provided data. Multi-source synthesis. We'll go through eac
CVE-2026-12990 HIGH
7.7 Jul 27

Ghost Robotics Vision 60 mobile app (APK v5.5.0) fails to enforce single-client sessions, allowing an unauthenticated at

Same weakness CWE-300 – Channel Accessible by Non-Endpoint

View all
CVE-2021-21953 HIGH POC
8.1
CVE-2023-32634 HIGH POC
7.4
CVE-2017-7480 CRITICAL
9.8
CVE-2019-3793 CRITICAL
9.8
CVE-2024-45407 MEDIUM POC
5.3
CVE-2024-31206 HIGH
8.2
CVE-2020-11024 HIGH
8.2
CVE-2025-31214 HIGH
8.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-49181 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy