Technical impact
Unitree Robotics Unitree Go2 phones its cloud interface via a WebSocket client that omits proper server certificate validation. The flaw allows a remote attacker to present a forged TLS certificate and establish a trusted connection, exposing the data channel to interception and manipulation. Because this bypass occurs before any authentication, it can undermine confidentiality and integrity of control messages and potentially enable further exploitation. The vendor reports a high complexity required for exploitation and difficulty, yet the remote nature of the attack makes it a serious risk when the component is reachable over a network.
Affected Systems
The vulnerability affects Unitree Robotics’ Go2 robot firmware up to and including versions 1.1.13, 1.1.14.1, and 1.1.15.1. The issue resides in the chat_go component’s websocket.py file within the WebSocketClient.connect method.
Risk and Exploitability
The CVSS score of 6.3 places the weakness in the moderate‑severe range, and the lack of an EPSS ranking or KEV listing does not negate the potential impact. The attack is feasible from a remote location, though the CVE notes it is a high‑complexity, difficult exploit. Proper validation of TLS certificates would eliminate the vector, so the risk is largely mitigated by upgrading firmware or disabling the vulnerable client usage.
