PT-2026-22178 · Unitree+1 · Unitree Go2+1

Olivier Laflamme

+1

·

Published

2026-02-26

·

Updated

2026-03-17

·

CVE-2026-27509

CVSS v3.1
8.0
VectorAV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Unitree Go2 firmware versions 1.1.7 through 1.1.9 and 1.1.11 (EDU)
Description The affected firmware does not implement DDS authentication or authorization for the Eclipse CycloneDDS topic /rt/api/programming actuator/request managed by actuator manager.py. An attacker positioned on the same network, without needing to authenticate, can join DDS domain 0 and send a crafted message (api id=1002) containing arbitrary Python code. This code is then written to the disk at /unitree/etc/programming/ and linked to a keybinding on a physical controller. When this keybinding is activated, the code executes with root privileges, and this binding remains active even after reboots.
Recommendations Update firmware to a version beyond 1.1.11 (EDU).

Exploit

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-27509

Affected Products

Eclipse Cyclonedds
Unitree Go2