CVE-2025-2894

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2894
The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control over the affected robotic device using the CloudSail remote access service.

6.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/Unitree_report.pdf Exploit Third Party Advisory
https://github.com/unitreerobotics/unitree_ros/issues/120 Issue Tracking Third Party Advisory
https://takeonme.org/cves/cve-2025-2894/ Exploit Mitigation Third Party Advisory
https://www.axios.com/2025/04/01/threat-spotlight-backdoor-in-chinese-robots-future-of-cybersecurity Press/Media Coverage
https://x.com/d0tslash/status/1730989109332607208 Press/Media Coverage
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:unitree:go1_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitree:go1:-:*:*:*:*:*:*:*
History

12 Jan 2026, 16:10

Type Values Removed Values Added
References () https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/Unitree_report.pdf - () https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/Unitree_report.pdf - Exploit, Third Party Advisory
References () https://github.com/unitreerobotics/unitree_ros/issues/120 - () https://github.com/unitreerobotics/unitree_ros/issues/120 - Issue Tracking, Third Party Advisory
References () https://takeonme.org/cves/cve-2025-2894/ - () https://takeonme.org/cves/cve-2025-2894/ - Exploit, Mitigation, Third Party Advisory
References () https://www.axios.com/2025/04/01/threat-spotlight-backdoor-in-chinese-robots-future-of-cybersecurity - () https://www.axios.com/2025/04/01/threat-spotlight-backdoor-in-chinese-robots-future-of-cybersecurity - Press/Media Coverage
References () https://x.com/d0tslash/status/1730989109332607208 - () https://x.com/d0tslash/status/1730989109332607208 - Press/Media Coverage
First Time Unitree
Unitree go1
Unitree go1 Firmware
CPE cpe:2.3:o:unitree:go1_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitree:go1:-:*:*:*:*:*:*:*

03 Apr 2025, 15:15

Type Values Removed Values Added
References
  • () https://www.axios.com/2025/04/01/threat-spotlight-backdoor-in-chinese-robots-future-of-cybersecurity -
Summary
  • (es) El Go1, también conocido como "El primer robot cuadrúpedo biónico inteligente del mundo, compañero de nivel de consumidor", contiene una puerta trasera no documentada que puede permitir al fabricante, y a cualquier persona en posesión de la clave API correcta, tener control remoto completo sobre el dispositivo robótico afectado mediante el servicio de acceso remoto CloudSail.

28 Mar 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-28 03:15

Updated : 2026-01-12 16:10

NVD link : CVE-2025-2894

Mitre link : CVE-2025-2894

CVE.ORG link : CVE-2025-2894

JSON object : View

Products Affected

unitree

  • go1_firmware
  • go1
CWE
CWE-912

Hidden Functionality