GCVE - cpe:2.3:a:unitree:g1:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unitree:g1:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unitree (`6a056451-a5ae-5bdc-a853-ac076f310540`)
Product	G1 (`856dd6fd-6b28-5fde-831b-af49c5c31faf`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-60251`	vulnerable	2026-06-03 15:07:55.985799	Details available MEDIUM (5) Unitree Go2, G1, H1, and B2 devices through 2025-09-20 accept any handshake secret with the unitree substring. Published: 2025-09-26T00:00:00.000Z Updated: 2025-09-26T14:49:50.498Z Open on db.gcve.eu Reference links https://spectrum.ieee.org/unitree-robot-exploit https://github.com/Bin4ry/UniPwn https://news.ycombinator.com/item?id=45381590	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-60250`	vulnerable	2026-06-03 15:07:55.985269	Details available MEDIUM (4.7) Unitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the df98b715d5c6ed2b25817b6f2554124a key and the 2841ae97419c2973296a0d4bdfe19a4f IV. Published: 2025-09-26T00:00:00.000Z Updated: 2025-09-26T19:18:16.378Z Open on db.gcve.eu Reference links https://spectrum.ieee.org/unitree-robot-exploit https://github.com/Bin4ry/UniPwn https://news.ycombinator.com/item?id=45381590	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-60017`	vulnerable	2026-06-03 15:07:55.470535	Details available HIGH (8.2) Unitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass parameter (within restart_wifi_ap and restart_wifi_sta). Published: 2025-09-26T00:00:00.000Z Updated: 2025-09-26T19:17:06.504Z Open on db.gcve.eu Reference links https://spectrum.ieee.org/unitree-robot-exploit https://github.com/Bin4ry/UniPwn https://news.ycombinator.com/item?id=45381590	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-35027`	vulnerable	2026-06-03 15:00:51.886855	Unitree Multiple Robotic Products Command Injection HIGH (7.3) Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service, an attacker can ultimately trigger commands to be run as root via the wpa_supplicant_restart.sh shell script. All Unitree models use firmware derived from the same codebase (MIT Cheetah), and the two major forks are the G1 (humanoid) and Go2 (quadruped) branches. Published: 2025-09-26T06:53:49.585Z Updated: 2025-10-07T21:10:12.489Z Open on db.gcve.eu Reference links https://takeonme.org/cves/cve-2025-35027 https://github.com/Bin4ry/UniPwn https://spectrum.ieee.org/unitree-robot-exploit https://x.com/committeeonccp/status/1971250635548033311 https://www.cve.org/cverecord?id=CVE-2025-60017	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.