PT-2026-22179 · Unitree · Unitree Go2 Android Application+1
Olivier Laflamme
+1
·
Published
2026-02-26
·
Updated
2026-06-16
·
CVE-2026-27510
CVSS v3.1
9.6
Critical
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Unitree Go2 versions 1.1.7 through 1.1.11
Description
Remote code execution is possible due to a lack of integrity protection and validation of user-created programs when used with the Unitree Go2 Android application (com.unitree.doggo2). The application stores programs in a local SQLite database (
unitree go2.db, table dog programme) and transmits the programme text content, specifically the pyCode field, to the robot. The robot's actuator manager.py function executes the provided Python code as root without verifying its integrity or validating the content. An attacker with local access to the Android device can manipulate the stored program record to inject arbitrary Python code, which executes when the user triggers the program via a controller keybinding; this malicious binding persists after reboots. Furthermore, importing and running a malicious program shared through the application's community marketplace can lead to arbitrary code execution on the robot.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Unitree Go2 Android Application
Unitree Go2 Firmware