Medium severity · published Mar 28, 2025
CVE-2025-2894
Unitree Go1 Robot Dog Backdoor Control Channel
6.6
CVSS
0.9%
EPSS
No
On KEV
Description
The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control over the affected robotic device using the CloudSail remote access service.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
Go1 · Unitree
2022_05_11_e0d0e617 · source: vendor
GF
Go1 Firmware · Unitree
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2894
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2894
Exploit
https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/Unitree_report.pdf
Issue Tracking
https://github.com/unitreerobotics/unitree_ros/issues/120
Exploit
https://takeonme.org/cves/cve-2025-2894/
Press/Media Coverage
https://www.axios.com/2025/04/01/threat-spotlight-backdoor-in-chinese-robots-future-of-cybersecurity
Press/Media Coverage
https://x.com/d0tslash/status/1730989109332607208