Vulnerabilities

CVSS

6.6 Medium

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Risk score

52.8

Published

2025-03-28

Status

Analyzed

The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control over the affected robotic device using the CloudSail remote access service.

Weaknesses

CWE-912

Coverage 1

threat-intel

FCC Blocks New Foreign-Produced Robots and Power Inverters Over Cyber Risks

The FCC has added foreign-produced mobile robots and networked power inverters to its Covered List, aiming to mitigate cybersecurity risks associated with these devices. This action prevents new models from receiving equ…

The Hacker News · Jul 30, 2026 High

CVE-2025-35027CVE-2025-2894UNcybersecuritynational securitysupply chain

All articles mentioning it

Advisories and references

• github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/Unitree_report...
• github.com/unitreerobotics/unitree_ros/issues/120
• takeonme.org/cves/cve-2025-2894/
• axios.com/2025/04/01/threat-spotlight-backdoor-in-chinese-robots-fut...
• x.com/d0tslash/status/1730989109332607208