PT-2026-22294 · Unitree · Unitree Go2

Todb · Published 2026-02-27 · Updated 2026-03-11 · CVE-2026-1442

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Unitree Go2 and other models versions (affected versions not specified)

Description The encryption algorithm used to protect firmware updates is encrypted using key material accessible to attackers. This allows unauthorized modification of firmware updates, which can then be trusted by Unitree products. The issue affects the firmware generation and extraction processes. Currently, there is no publicly documented method to bypass the update process and inject malicious firmware packages without the owner's knowledge.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2026-1442

Affected Products

Unitree Go2

References · 14

• 🔥 https://github.com/Bin4ry/UniTEABag · Exploit
• 🔥 http://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000001111111111110101111111111000000000000000000000000000000000000000000000000000000101 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1442 · Security Note
• https://twitter.com/Bin4ryDigit/status/2027197985625420242 · Twitter Post
• https://twitter.com/d0tslash/status/2027254217207906344 · Twitter Post
• https://x.com/bin4rydigit/status/2027197985625420242 · Note
• https://t.me/CVEtracker/45934 · Telegram Post
• https://twitter.com/cracbot/status/2029149995455398263 · Twitter Post
• https://twitter.com/CVEnew/status/2027380200447619442 · Twitter Post
• https://linkedin.com/posts/kevin-finisterre-6431069a_in-case-you-want-to-teabag-unitree-robotics-activity-7432984361014091776-zB4D · Note
• https://t.me/cveNotify/155163 · Telegram Post
• https://twitter.com/grok/status/2029006400135819326 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027282729574817961 · Twitter Post
• https://t.me/cveNotify/153420 · Telegram Post