CVE-2025-60250 is a medium-severity vulnerability identified in Unitree's robotic devices, specifically the Go2, G1, H1, and B2 models. The vulnerability arises from the use of a hard-coded cryptographic key (df98b715d5c6ed2b25817b6f2554124a) and initialization vector (IV) (2841ae97419c2973296a0d4bdfe19a4f) to decrypt Bluetooth Low Energy (BLE) packet data. This practice violates secure cryptographic principles as hard-coded keys are static and can be extracted by attackers through reverse engineering or firmware analysis. Once the key and IV are known, an adversary can decrypt BLE communications between the device and its controller or other peripherals, potentially allowing them to intercept sensitive data or manipulate device behavior. The vulnerability has a CVSS 3.1 base score of 4.7, reflecting a medium severity level. The vector string (AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) indicates that the attack requires adjacent network access (e.g., Bluetooth proximity), has low attack complexity, requires no privileges or user interaction, and impacts integrity with a scope change, but does not affect confidentiality or availability. No known exploits are currently reported in the wild, and no patches have been published as of the vulnerability disclosure date (September 26, 2025). The affected devices are robotic platforms used in various applications including research, inspection, and potentially commercial or industrial environments. The CWE-321 classification highlights the fundamental cryptographic weakness of embedding static keys in code, which undermines the security of encrypted communications and can facilitate unauthorized control or data manipulation.

For European organizations deploying Unitree robotic devices, this vulnerability could lead to unauthorized manipulation of robotic operations or interception of BLE communications. Although confidentiality is not directly impacted, the integrity of commands and data exchanged with the devices can be compromised, potentially causing operational disruptions or safety risks if robots are used in sensitive environments such as manufacturing, logistics, or research facilities. The requirement for adjacent network access limits remote exploitation but does not eliminate risk in environments where attackers can gain physical proximity, such as warehouses, campuses, or public spaces. The scope change in the CVSS vector suggests that a successful exploit could affect components beyond the initially targeted BLE communication channel, potentially impacting the broader system controlling the robot. Given the increasing adoption of robotics in European industries and research institutions, this vulnerability could undermine trust in robotic automation and necessitate additional security controls to prevent misuse.

To mitigate this vulnerability, European organizations should first monitor Unitree's official channels for firmware updates or patches addressing the hard-coded key issue and apply them promptly once available. In the absence of patches, organizations should implement compensating controls such as restricting physical and Bluetooth access to the robots by enforcing strict access controls and using Bluetooth signal jamming or shielding in sensitive areas to prevent unauthorized proximity. Network segmentation and monitoring of BLE traffic can help detect anomalous communication attempts. Additionally, organizations should consider deploying endpoint detection solutions capable of identifying unusual commands or behaviors from the robots. For future procurement, organizations should require vendors to follow secure cryptographic practices, including dynamic key management and secure key storage mechanisms. Finally, conducting regular security assessments and penetration tests focusing on BLE communications and robotic control interfaces will help identify and remediate related weaknesses.