CVE-2025-2894

Medium6.6Published on March 28, 2025

The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control over the affected robotic device using the CloudSail remote access service.

CVSS score6.6 / 10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-912

Vendorsunitree

Affected products

Vendors	Product	Versions
unitree	go1 firmware	-
unitree	go1	-

Vulnerabilities

FCC Bans Foreign Mobile Robots and Power Inverters: Third Supply Chain Ban Takes Effect

The FCC expanded its Covered List to ban new foreign mobile robots and connected power inverters due to national security risks and severe vulnerabilities.

Jul 30, 202617:143 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

FCC Bans Foreign Mobile Robots and Power Inverters: Third Supply Chain Ban Takes Effect