Authentication Flaw in Ghost Robotics Vision 60 by Ghost Robotics

CVE-2025-41109

What is CVE-2025-41109?

The Ghost Robotics Vision 60 version 0.27.2 is vulnerable due to inadequate authentication mechanisms on its physical interfaces, including three RJ45 connectors and a USB Type-C port. This flaw allows an adversary to connect unauthorized devices easily, such as a malicious WiFi access point. The robot's internal router can assign IP addresses to devices indiscriminately. Consequently, an attacker can infiltrate the robot's network without needing correct credentials, granting them the ability to monitor sensitive data processed by the robot, which operates on ROS 2 without default authentication.

References