Unauthenticated RCE flaws (CVE-2026-27509, CVE-2026-27510) found in Unitree Go2
S1 · ~Oct 2025 · Unitree
Record
| Company | Unitree |
| Industry | Humanoid robots |
| Type(s) | cyber |
| Date | ~Oct 2025 (month precision) |
| Time of day | not documented |
| Location | no physical site (recall / fleet-wide / aggregate record) |
| Severity | (near-miss / disclosed vulnerability) |
| Scale | fleet-wide (Go2 model, firmware V1.1.7/V1.1.11) |
| Confidence | high |
| Verified flag | Cited source on file; not independently re-verified |
Summary
A researcher disclosed two unauthenticated remote-code-execution vulnerabilities in the Unitree Go2 quadruped's actuator control system, one abusing a DDS DataWriter to run arbitrary Python as root and one tampering with pre-programmed Blockly action data stored in the companion Android app.
Primary source
boschko.ca (independent researcher writeup)
Publisher: boschko.ca (independent researcher writeup) · Retrieved: 2026-09-16
Supporting source rows (1)
| Date | Supporting source row | Publisher | Link |
|---|---|---|---|
| ~Oct 2025 | Unauthenticated RCE flaws (CVE-2026-27509, CVE-2026-27510) found in Unitree Go2 | boschko.ca (independent researcher writeup) | boschko.ca |
Unitree other incidents timeline
Humanoid robots context
cyber context
Unitree industry position
Related incidents
Other Unitree entries
- 07 Sep 2026 - Unitree humanoid unexpectedly lunges at engineer and kicks remote control from his hand during test
- 27 Aug 2026 - Two root RCE flaws (CVE-2026-76639/76640) disclosed in Unitree G1 EDU
- ~Jul 2026 - FCC bars new Unitree robot models from US import/sale over backdoor concerns
- ~Dec 2025 - Unitree G1 accidentally kicks its own teleoperator during motion-mirroring demo
- ~Sep 2025 - UniPwn wormable Bluetooth exploit roots Unitree Go2, B2, G1 and H1
- not documented - Unitree G1 robot kicks child in stomach during Xinjiang demo
- not documented - Backdoor (CVE-2025-2894) found in Unitree Go1 robot firmware
- not documented - Unitree H1 humanoid flails violently and nearly injures two engineers during test
Report a correction
Also from Critical Systems Analysis: CSA - functional safety engineering · Company directory · FSTalent - functional safety jobs