Medium severity · published Aug 5, 2022
CVE-2022-2675
Unitree Go 1 "Robot Dog" Unauthenticated Remote Power Down
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Using off-the-shelf commodity hardware, the Unitree Go 1 robotics platform version H0.1.7 and H0.1.9 (using firmware version 0.1.35) can be powered down by an attacker within normal RF range without authentication. Other versions may be affected, such as the A1.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
G1
Go 1 · Unitree
0.1.35 through 0.1.35; 0.1.35 before 0.1.35 · source: vendor
G1
GO 1 Firmware · Unitree
through 0.1.35; before 0.1.35 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2675
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2675
Product
https://fccid.io/2A5PE-YUSHU001/Users-Manual/User-Manual-5810729
Third Party Advisory
https://twitter.com/d0tslash/status/1555326302462394370
Product
https://www.mybotshop.de/Datasheet/Unitree_A1_User_Manual_v1.0.pdf