Vision 60
Monthly
Man-in-the-middle attack against Ghost Robotics Vision 60 robot firmware v5.5.0 allows local network attackers to intercept and manipulate communications, disconnect legitimate operators, and take unauthorized control of the quadruped robot, completely compromising confidentiality, integrity, and availability of operations. No active exploitation has been reported in CISA KEV, and no public exploit code was identified at time of analysis.
Ghost Robotics Vision 60 mobile app (APK v5.5.0) fails to enforce single-client sessions, allowing an unauthenticated attacker with a modified app on the adjacent network to connect to the robot while a legitimate operator is active. The attacker can intercept real-time video and send commands without alerting the legitimate user, compromising confidentiality and operational control. No active exploitation or public exploit code has been identified; a vendor patch is available.
Missing authentication in Ghost Robotics' Vision 60 quadruped robot - specifically in the mobile app (APK v5.5.0) exposing its web administration interface and HTTP API - lets an unauthenticated attacker who is associated to the robot's own internal Wi-Fi network take full control of the platform (CWE-306). From that position the attacker can view live camera feeds, command movement, manage the GPS, RTK, SAM and LIDAR sensor suite, and issue critical operational commands including Play, Pause, Stop and E-Stop, resulting in complete loss of confidentiality, integrity and physical safety. Exploitation is bounded by the requirement to be within and joined to the robot's private Wi-Fi (CVSS 4.0 AV:A, PR:N, score 8.7), it is assessed as not automatable, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is 0.19% (10th percentile), consistent with a technically severe but narrowly reachable flaw.
Man-in-the-middle attack against Ghost Robotics Vision 60 robot firmware v5.5.0 allows local network attackers to intercept and manipulate communications, disconnect legitimate operators, and take unauthorized control of the quadruped robot, completely compromising confidentiality, integrity, and availability of operations. No active exploitation has been reported in CISA KEV, and no public exploit code was identified at time of analysis.
Ghost Robotics Vision 60 mobile app (APK v5.5.0) fails to enforce single-client sessions, allowing an unauthenticated attacker with a modified app on the adjacent network to connect to the robot while a legitimate operator is active. The attacker can intercept real-time video and send commands without alerting the legitimate user, compromising confidentiality and operational control. No active exploitation or public exploit code has been identified; a vendor patch is available.
Missing authentication in Ghost Robotics' Vision 60 quadruped robot - specifically in the mobile app (APK v5.5.0) exposing its web administration interface and HTTP API - lets an unauthenticated attacker who is associated to the robot's own internal Wi-Fi network take full control of the platform (CWE-306). From that position the attacker can view live camera feeds, command movement, manage the GPS, RTK, SAM and LIDAR sensor suite, and issue critical operational commands including Play, Pause, Stop and E-Stop, resulting in complete loss of confidentiality, integrity and physical safety. Exploitation is bounded by the requirement to be within and joined to the robot's private Wi-Fi (CVSS 4.0 AV:A, PR:N, score 8.7), it is assessed as not automatable, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is 0.19% (10th percentile), consistent with a technically severe but narrowly reachable flaw.