Unitree Go2
Monthly
OS command injection in Unitree Go2's chat_go voice-chat component (gpt_thread.py set_volume) through firmware 1.1.11.4 lets unauthenticated remote attackers execute shell commands by supplying a crafted Value argument, with a user-interaction precondition. The vendor has released firmware 1.1.11.5 to resolve the issue, and the supplied priority is act_now. No CISA KEV listing is included in the supplied data and no public exploit identified at time of analysis; exposure depends on whether chat_go is reachable from untrusted networks.
Unitree Go2 firmware up to the 1.1.13, 1.1.14.1, and 1.1.15.1 releases contains a chat_go WebSocket client that does not validate TLS server certificates, allowing a man-in-the-middle to impersonate the WSS server and potentially read or alter traffic. Exploitation requires the attacker to first obtain a privileged network intercept position, which the assessment rates as high complexity and difficult; no authentication or user interaction is required once that position exists. The vendor has confirmed the issue, no public exploit code has been identified at time of analysis, and this is a moderate, not emergency, priority.
OS command injection in Unitree Go2's chat_go voice-chat component (gpt_thread.py set_volume) through firmware 1.1.11.4 lets unauthenticated remote attackers execute shell commands by supplying a crafted Value argument, with a user-interaction precondition. The vendor has released firmware 1.1.11.5 to resolve the issue, and the supplied priority is act_now. No CISA KEV listing is included in the supplied data and no public exploit identified at time of analysis; exposure depends on whether chat_go is reachable from untrusted networks.
Unitree Go2 firmware up to the 1.1.13, 1.1.14.1, and 1.1.15.1 releases contains a chat_go WebSocket client that does not validate TLS server certificates, allowing a man-in-the-middle to impersonate the WSS server and potentially read or alter traffic. Exploitation requires the attacker to first obtain a privileged network intercept position, which the assessment rates as high complexity and difficult; no authentication or user interaction is required once that position exists. The vendor has confirmed the issue, no public exploit code has been identified at time of analysis, and this is a moderate, not emergency, priority.