Unitree Go2
Approved changes feed: RSS · Atom
cpe:2.3:a:unitree_robotics:unitree_go2:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unitree Robotics (9f6006d5-6eb7-51a2-85c5-1dfc680436df) |
|---|---|
| Product | Unitree Go2 (d27f22fc-bc5e-5446-b9d0-f08d5fd2bd1b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-115996 |
vulnerable | 2026-11-03 10:15:37.691822 |
Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation
LOW (3.7)
A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."
Published: 2026-10-24T22:30:21.197Z
Updated: 2026-10-26T17:37:33.986Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115995 |
vulnerable | 2026-11-03 10:15:37.486621 |
Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection
CRITICAL (9.6)
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."
Published: 2026-10-24T22:15:15.915Z
Updated: 2026-10-29T15:27:21.823Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.