Insecure Permissions in Unitree Go1 Robots
CVE-2025-45467

7.1HIGH

Key Information:

Vendor

Unitree

Status
Go1
Vendor
CVE Published:
25 July 2025

What is CVE-2025-45467?

The Unitree Go1 robot model, specifically versions up to Go1_2022_05_11, is prone to an insecure permissions vulnerability in its firmware update process. This vulnerability occurs due to a flawed verification mechanism that relies solely on MD5 checksums for validating firmware integrity. This approach poses significant security risks, as attackers could potentially exploit this flaw to install unauthorized firmware or execute malicious code remotely, thereby compromising the security and functionality of the device.

References

https://www.unitree.com/cn/go1
https://github.com/zgsnj123/CVE-2025-45467/tree/main

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.