{"id":183628,"date":"2025-10-01T23:02:10","date_gmt":"2025-10-01T23:02:10","guid":{"rendered":"https:\/\/www.newsbeep.com\/au\/183628\/"},"modified":"2025-10-01T23:02:10","modified_gmt":"2025-10-01T23:02:10","slug":"unitree-humanoid-robot-exploit-looks-like-a-bad-one","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/au\/183628\/","title":{"rendered":"Unitree Humanoid Robot Exploit Looks Like A Bad One"},"content":{"rendered":"

Unitree have a number of robotic offerings, and are one of the first manufacturers offering humanoid robotic platforms. It seems they are also the subject of UniPwn<\/a>, one of the first public exploits of a vulnerability across an entire robotic product line. In this case, the vulnerability allows an attacker not only to utterly compromise a device from within the affected product lines, but infected robots can also infect others within wireless range. This is done via a remote command-injection exploit that involves a robot\u2019s Bluetooth Low Energy (BLE) Wi-Fi configuration service.<\/p>\n

\"\"<\/a>Unitree\u2019s flagship G1<\/a> humanoid robot platform (one of the many models affected)<\/p>\n

While this may be the first public humanoid robot exploit we have seen (it also affects their quadruped models), the lead-up to announcing the details in a post on X<\/a> is a familiar one. Researchers discover a security vulnerability and attempt responsible disclosure by privately notifying the affected party. Ideally the manufacturer responds, communicates, and fixes the vulnerability so devices are no longer vulnerable by the time details come out. That\u2019s not always how things go. If efforts at responsible disclosure fail and action isn\u2019t taken, a public release can help inform people of a serious issue, and point out workarounds and mitigations to a vulnerability that the manufacturer isn\u2019t addressing.<\/p>\n

The biggest security issues involved in this vulnerability (summed up in a total of four CVEs<\/a>) include:<\/p>\n

Hardcoded cryptographic keys for encrypting and decrypting BLE control packets (allowing anyone with a key to send valid packets.)
\nTrivial handshake security (consists simply of checking for the string \u201cunitree\u201d as the secret.)
\nUnsanitized user data that gets concatenated into shell commands and passed to system().<\/p>\n

The complete attack sequence is a chain of events that leverages the above in order to ultimately send commands which run with root privileges.<\/p>\n

We\u2019ve seen a Unitree security glitch before, but it was used to provide an unofficial SDK that opened up expensive features of the Go1 \u201crobot dog\u201d model for free<\/a>. This one is rather more serious and reportedly affects not just the humanoid models, but also newer quadrupeds such as the Go2 and B2. The whole exploit is comprehensively documented, so get a fresh cup of whatever you\u2019re drinking before sitting down to read through it.<\/p>\n","protected":false},"excerpt":{"rendered":"Unitree have a number of robotic offerings, and are one of the first manufacturers offering humanoid robotic platforms.…\n","protected":false},"author":2,"featured_media":183629,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[256,254,255,64,63,105],"class_list":{"0":"post-183628","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-artificial-intelligence","8":"tag-ai","9":"tag-artificial-intelligence","10":"tag-artificialintelligence","11":"tag-au","12":"tag-australia","13":"tag-technology"},"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/183628","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=183628"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/183628\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/183629"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=183628"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=183628"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=183628"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}