PT-2025-39471 · Unitree · Unitree B2+3

Published 2025-09-26 · Updated 2025-10-05 · CVE-2025-60251

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Unitree Go2, G1, H1, and B2 devices through September 20, 2025

Description The devices accept any handshake secret containing the substring 'unitree'. This allows unauthorized access and control of the devices.

Recommendations Update devices to a version after September 20, 2025.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-60251

Affected Products

Unitree B2

Unitree Go 1

Unitree Go2

Unitree H1

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-60251 · Security Note
• https://github.com/Bin4ry/UniPwn · Note
• https://twitter.com/VulmonFeeds/status/1971537768636452928 · Twitter Post
• https://spectrum.ieee.org/unitree-robot-exploit · Note
• https://twitter.com/d0tslash/status/1974930361995108849 · Twitter Post
• https://twitter.com/CVEnew/status/1971404417128870243 · Twitter Post
• https://t.me/CVEtracker/33394 · Telegram Post
• https://t.me/cveNotify/136490 · Telegram Post
• https://news.ycombinator.com/item?id=45381590 · Note