Andreas Makris

**Name of the Vulnerable Software and Affected Versions** Yarbo version 2.3.9 **Description** A hidden, persistent backdoor provides remote, unauthenticated or weakly authenticated access to privileged functionality. This backdoor is undocumented, cannot be disabled through user-facing settings, and persists after factory resets and standard firmware updates. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Yarbo firmware version 2.3.9 **Description** The firmware contains hardcoded administrative credentials embedded in the image. These credentials are identical across all devices and cannot be modified or removed by end users, allowing unauthorized access to device management interfaces. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Yarbo firmware version 2.3.9 **Description** The embedded MQTT broker is configured to permit anonymous connections and lacks topic-level read or write Access Control Lists (ACLs). This allows any host on the same network to subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Unitree robotic products (Go2, G1, H1, and B2 devices) **Description** Multiple Unitree robotic products sharing a common firmware contain a command injection issue. An attacker can inject a malicious string during WiFi configuration via a BLE module, and then trigger a restart of the WiFi service. This allows the attacker to execute commands as root through the `wpa supplicant restart.sh` shell script. The vulnerability affects devices using firmware derived from the MIT Cheetah codebase, including the G1 (humanoid) and Go2 (quadruped) branches. **Recommendations** Unitree Go2 robots: Consider temporarily disabling the bluetooth protocol as a mitigation measure. Unitree G1 robots: Consider temporarily disabling the bluetooth protocol as a mitigation measure. Unitree H1 robots: Consider temporarily disabling the bluetooth protocol as a mitigation measure. Unitree B2 robots: Consider temporarily disabling the bluetooth protocol as a mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UnitreeRobotics Zhexi/Oray (affected versions not specified) **Description** The issue concerns an undocumented backdoor in the robotic device. This backdoor allows the manufacturer and anyone with the correct API key to gain complete remote control over the device using the CloudSail remote access service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.