PT-2026-22179 · Unitree · Unitree Go2 Android Application+1

Olivier Laflamme

+1

·

Published

2026-02-26

·

Updated

2026-03-17

·

CVE-2026-27510

CVSS v3.1
9.6
VectorAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Unitree Go2 firmware versions 1.1.7 through 1.1.11
Description Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are susceptible to remote code execution because of a lack of integrity protection and validation of user-created programs. The Android application stores programs in a local SQLite database (unitree go2.db, table dog programme) and transmits the programme text content, including the pyCode field, to the robot. The robot’s actuator manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can manipulate the stored program record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the application’s community marketplace can result in arbitrary code execution on any robot that imports and runs it.
Recommendations For versions 1.1.7 through 1.1.11, avoid importing programs from untrusted sources through the application's community marketplace. For versions 1.1.7 through 1.1.11, restrict local access to the Android device to prevent tampering with the stored program records. For versions 1.1.7 through 1.1.11, as a temporary workaround, consider disabling or restricting the use of the actuator manager.py function until a patch is available.

Exploit

Fix

RCE

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-27510

Affected Products

Unitree Go2 Android Application
Unitree Go2 Firmware