Root OS Command Injection Vulnerability in Unitree Robot Devices

CVE-2025-60017

What is CVE-2025-60017?

The vulnerability in Unitree's Go2, G1, H1, and B2 devices allows for root OS command injection through improperly validated input in the hostapd_restart.sh script. This occurs when malicious actors manipulate the wifi_ssid or wifi_pass parameters during the restart process of the Wi-Fi access point. Exploitation of this flaw can lead to unauthorized access and control over the device's operating system, posing significant security risks to users.

References