PT-2025-39469 · Unitree · Unitree B2+3

Published 2025-09-26 · Updated 2025-10-05 · CVE-2025-60017

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Unitree Go2, G1, H1, and B2 devices through 2025-09-20

Description The devices allow for root operating system command injection. This is possible through the hostapd restart.sh script, specifically via the wifi ssid or wifi pass parameters within the restart wifi ap and restart wifi sta functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-60017

Affected Products

Unitree B2

Unitree Go 1

Unitree Go2

Unitree H1

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-60017 · Security Note
• https://github.com/Bin4ry/UniPwn · Note
• https://spectrum.ieee.org/unitree-robot-exploit · Note
• https://news.ycombinator.com/item?id=45381590 · Note
• https://t.me/CVEtracker/33392 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1971542888535240705 · Twitter Post
• https://twitter.com/d0tslash/status/1974930361995108849 · Twitter Post
• https://twitter.com/cracbot/status/1973342163078422585 · Twitter Post
• https://t.me/cveNotify/136476 · Telegram Post
• https://t.me/cveNotify/136488 · Telegram Post
• https://twitter.com/CVEnew/status/1971404415052677269 · Twitter Post