CVE-2025-2894

Katalog CVE

CVSS 6.6 · Medium EPSS 0,86%

Kerentanan Hidden Functionality pada unitree go1 firmware. Skor CVSS 3.1 6.6 (Medium) menurut takeonme.org.

Deskripsi (NVD)

The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control over the affected robotic device using the CloudSail remote access service.

Rincian

Terbit di NVD

28 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.6 (Medium), sumber takeonme.org
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-912: Hidden Functionality

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://takeonme.org/cves/cve-2025-2894/ exploit · mitigasi · advisory pihak ketiga
• https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/Unitree_report.pdf exploit · advisory pihak ketiga
• https://github.com/unitreerobotics/unitree_ros/issues/120 issue tracking · advisory pihak ketiga
• https://www.axios.com/2025/04/01/threat-spotlight-backdoor-in-chinese-robots-future-of-cybersecurity press/media coverage
• https://x.com/d0tslash/status/1730989109332607208 press/media coverage