High severity · published Nov 22, 2023
CVE-2023-3104
Missing Authentication for Critical Function in Unitree Robotics A1
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A1
A1 · Unitree Robotics
1.16 · source: vendor
AF
A1 Firmware · Unitree
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3104
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3104
Vendor Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-unitree-robotics-a1
More from A1
5.9
CVE-2023-3103
Authentication Bypass by Spoofing in Unitree Robotics A1