CVE-2025-2894 Unitree Go1 Robot Dog Backdoor Control Channel
An undocumented backdoor allows remote control of the Unitree Go1 robot dog via a hardcoded API key, enabling unauthorized access and control.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-2894?
CVE-2025-2894 is a medium-severity vulnerability in Unitree Go1, published on 28 Mar 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control over the affected robotic device using the CloudSail remote access service.
Weakness: CWE-912
Which versions are affected by CVE-2025-2894?
It affects 1 product.
Products include Unitree Go1 Firmware.
How do I fix CVE-2025-2894?
No fix has been published for CVE-2025-2894 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-2894 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-2894 exists.
Other vulnerabilities in Unitree Go1
Sources
Also known as GHSA-23cv-w96c-877f.