Medium severity · published Sep 21, 2025
CVE-2025-10772
huggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authentication
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robot_devices/robots/lekiwi_remote.py of the component ZeroMQ Socket Handler. The manipulation leads to missing authentication. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
LeRobot · huggingface
0.3.0; 0.3.1; 0.3.2; 0.3.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10772
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10772
vuldb.com
https://vuldb.com/?ctiid.325128
vuldb.com
https://vuldb.com/?id.325128
vuldb.com
https://vuldb.com/?submit.649798
More from LeRobot
9.8
CVE-2026-25874
LeRobot Unsafe Deserialization Remote Code Execution via gRPC
