2 lines
3.1 KiB
JSON
2 lines
3.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Go1","vendor":"Unitree","versions":[{"status":"affected","version":"2022_05_11_e0d0e617"}]}],"source":"cve@takeonme.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:unitree:go1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3A800D2C-2D63-452E-B234-DE9CA4E5C127","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:unitree:go1:-:*:*:*:*:*:*:*","matchCriteriaId":"8E8C711A-D435-40B3-9399-FBA7105BE1AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Go1 also known as \"The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level,\" contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control over the affected robotic device using the CloudSail remote access service."},{"lang":"es","value":"El Go1, también conocido como \"El primer robot cuadrúpedo biónico inteligente del mundo, compañero de nivel de consumidor\", contiene una puerta trasera no documentada que puede permitir al fabricante, y a cualquier persona en posesión de la clave API correcta, tener control remoto completo sobre el dispositivo robótico afectado mediante el servicio de acceso remoto CloudSail."}],"id":"CVE-2025-2894","lastModified":"2026-06-17T09:07:48.727","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.9,"source":"cve@takeonme.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-2894","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-03-28T15:40:56.582769Z","version":"2.0.3"}}]},"published":"2025-03-28T03:15:18.780","references":[{"source":"cve@takeonme.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/Unitree_report.pdf"},{"source":"cve@takeonme.org","tags":["Issue Tracking","Third Party Advisory"],"url":"https://github.com/unitreerobotics/unitree_ros/issues/120"},{"source":"cve@takeonme.org","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://takeonme.org/cves/cve-2025-2894/"},{"source":"cve@takeonme.org","tags":["Press/Media Coverage"],"url":"https://www.axios.com/2025/04/01/threat-spotlight-backdoor-in-chinese-robots-future-of-cybersecurity"},{"source":"cve@takeonme.org","tags":["Press/Media Coverage"],"url":"https://x.com/d0tslash/status/1730989109332607208"}],"sourceIdentifier":"cve@takeonme.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-912"}],"source":"cve@takeonme.org","type":"Secondary"}]}
|