CVE-2026-27510

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27510", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-02-19T19:51:07.327Z", "datePublished": "2026-02-26T18:56:56.654Z", "dateUpdated": "2026-05-25T23:41:48.069Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-25T23:41:48.069Z"}, "title": "Unitree Go2 Mobile Program Tampering Enables Root RCE", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLite database (unitree_go2.db, table dog_programme) and transmits the programme_text content, including the pyCode field, to the robot. The robot's actuator_manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can tamper with the stored programme record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the application's community marketplace can result in arbitrary code execution on any robot that imports and runs it."}], "value": "Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLite database (unitree_go2.db, table dog_programme) and transmits the programme_text content, including the pyCode field, to the robot. The robot's actuator_manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can tamper with the stored programme record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the application's community marketplace can result in arbitrary code execution on any robot that imports and runs it."}], "affected": [{"defaultStatus": "unaffected", "product": "Unitree Go2", "vendor": "UnitreeRobotics", "versions": [{"status": "affected", "version": "1.1.7", "versionType": "semver", "lessThanOrEqual": "1.1.11"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "description": "CWE-345 Insufficient Verification of Data Authenticity", "lang": "en", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.4, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "source": {"discovery": "UNKNOWN"}, "references": [{"tags": ["technical-description", "exploit"], "url": "https://boschko.ca/unitree-go2-rce/"}, {"tags": ["product"], "url": "https://shop.unitree.com/products/unitree-go2"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/unitree-go2-mobile-program-tampering-enables-root-rce"}], "credits": [{"lang": "en", "value": "Olivier Laflamme", "type": "finder"}, {"lang": "en", "value": "Ruikai Peng", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T21:09:46.113186Z", "id": "CVE-2026-27510", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T21:10:20.489Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27510", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T21:09:46.113186Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T21:10:11.680Z"}}], "cna": {"title": "Unitree Go2 Mobile Program Tampering Enables Root RCE", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Olivier Laflamme"}, {"lang": "en", "type": "finder", "value": "Ruikai Peng"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "UnitreeRobotics", "product": "Unitree Go2", "versions": [{"status": "affected", "version": "1.1.7", "versionType": "semver", "lessThanOrEqual": "1.1.11"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://boschko.ca/unitree-go2-rce/", "tags": ["technical-description", "exploit"]}, {"url": "https://shop.unitree.com/products/unitree-go2", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/unitree-go2-mobile-program-tampering-enables-root-rce", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLite database (unitree_go2.db, table dog_programme) and transmits the programme_text content, including the pyCode field, to the robot. The robot's actuator_manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can tamper with the stored programme record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the application's community marketplace can result in arbitrary code execution on any robot that imports and runs it.", "supportingMedia": [{"type": "text/html", "value": "Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLite database (unitree_go2.db, table dog_programme) and transmits the programme_text content, including the pyCode field, to the robot. The robot's actuator_manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can tamper with the stored programme record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the application's community marketplace can result in arbitrary code execution on any robot that imports and runs it.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345 Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-25T23:41:48.069Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27510", "state": "PUBLISHED", "dateUpdated": "2026-05-25T23:41:48.069Z", "dateReserved": "2026-02-19T19:51:07.327Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-02-26T18:56:56.654Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Unitree Go2", "vendor": "UnitreeRobotics", "versions": [{"lessThanOrEqual": "1.1.11", "status": "affected", "version": "1.1.7", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:unitree:go2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7E214A36-96C5-47AB-89FA-5891DFC99288", "versionEndIncluding": "1.1.11", "versionStartIncluding": "1.1.7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:unitree:go2:-:*:*:*:*:*:*:*", "matchCriteriaId": "372BB5C0-26D8-4E99-A63E-F4FB2D0A50C2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLite database (unitree_go2.db, table dog_programme) and transmits the programme_text content, including the pyCode field, to the robot. The robot's actuator_manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can tamper with the stored programme record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the application's community marketplace can result in arbitrary code execution on any robot that imports and runs it."}, {"lang": "es", "value": "Las versiones de firmware de Unitree Go2 1.1.7 a 1.1.11, cuando se usan con la aplicaci\u00f3n de Android Unitree Go2 (com.unitree.doggo2), son vulnerables a la ejecuci\u00f3n remota de c\u00f3digo debido a la falta de protecci\u00f3n de integridad y validaci\u00f3n de programas creados por el usuario. La aplicaci\u00f3n de Android almacena programas en una base de datos SQLite local (unitree_go2.db, tabla dog_programme) y transmite el contenido de programme_text, incluido el campo pyCode, al robot. El archivo actuator_manager.py del robot ejecuta el Python suministrado como root sin verificaci\u00f3n de integridad o validaci\u00f3n de contenido. Un atacante con acceso local al dispositivo Android puede manipular el registro de programa almacenado para inyectar Python arbitrario que se ejecuta cuando el usuario activa el programa a trav\u00e9s de una asignaci\u00f3n de tecla del controlador, y la asignaci\u00f3n maliciosa persiste a trav\u00e9s de los reinicios. Adem\u00e1s, un programa malicioso compartido a trav\u00e9s del mercado comunitario de la aplicaci\u00f3n puede resultar en la ejecuci\u00f3n de c\u00f3digo arbitrario en cualquier robot que lo importe y ejecute."}], "id": "CVE-2026-27510", "lastModified": "2026-06-17T10:27:16.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "disclosure@vulncheck.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27510", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T21:09:46.113186Z", "version": "2.0.3"}}]}, "published": "2026-02-26T20:31:38.663", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://boschko.ca/unitree-go2-rce/"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://shop.unitree.com/products/unitree-go2"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/unitree-go2-mobile-program-tampering-enables-root-rce"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.1.7,1.1.9]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.1.11"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Unitree Go2", "source": "cna", "vendor": "UnitreeRobotics"}, "product": "unitree_go2", "vendor": "unitreerobotics"}], "analysis": {"en": {"generated_at": "2026-04-16T16:05:12.523936+00:00", "value": {"mitigation_remediation": ["Update the Unitree\u00a0Go2 firmware to version\u00a01.1.12 or later that includes integrity verification for user programs.", "Remove any tampered or suspicious programs from the local Android database to eliminate stored malicious code.", "Disable or restrict the community marketplace feature, or ensure that any shared programs are scanned and validated before import."], "summary": {"action": "Immediate Patch", "impact": "Root Remote Code Execution on Unitree\u00a0Go2 robots via tampered Android programs"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Unitree\u00a0Robotics\u2019 Unitree\u00a0Go2 robot, with firmware versions 1.1.7 up to 1.1.11. The Android client application com.unitree.doggo2 is required for the attack to be possible, and any robot running the affected firmware and using the application carries the risk.", "description_and_impact": "The Unitree\u00a0Go2 firmware from 1.1.7 through 1.1.11 is vulnerable because the Android application that manages user\u2011created programs does not validate the integrity of the stored program records. The program definition, particularly the python code field, is stored in a local SQLite database and later transmitted to the robot, where a server\u2011side script executes it as root. An attacker who can edit the Android device\u2019s database can inject arbitrary python that runs when the user triggers a keybinding, and that malicious binding remains after a device reboot. Consequently, a malicious program shared through the community marketplace can execute on any robot that imports and runs it, allowing an attacker to gain unrestricted root control of the robot and potentially compromise its communications or command interface.", "risk_and_exploitability": "The CVSSv3 score of 6.4 indicates a medium\u2011to\u2011high impact, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalogue. However, the risk to any connected system employing the flawed firmware remains significant: an attacker with local Android device access could install malicious code that is executed with root privileges on the robot. If the marketplace feature is enabled, community sharing of unreviewed programs also provides an attack vector that could affect any robot capable of importing such code."}}}}, "created": "2026-02-27T09:07:10.112037+00:00", "updated": "2026-04-16T16:15:08.460763+00:00", "vendors": ["unitreerobotics", "unitreerobotics$PRODUCT$unitree_go2"]}