The vulnerability CVE-2026-12989 involves missing authentication controls in the Ghost Robotics Vision 60 mobile app (APK v5.5.0). An attacker connected to the internal Wi-Fi network can gain unrestricted access to the robot's web administration interface and HTTP API. Due to the absence of authorization mechanisms, the attacker can perform sensitive operations including viewing real-time camera feeds, controlling robot movements, managing GPS, RTK, SAM, and LIDAR sensors, and issuing critical operational commands like Play, Pause, Stop, and Emergency Stop. This leads to a complete compromise of the robot's confidentiality, integrity, and physical security. The CVSS 4.0 base score is 8.7 (high severity), reflecting the ease of attack and the critical impact. No official patch or remediation guidance is currently available from the vendor, and the vulnerability affects exactly version 5.5.0 of the mobile app.

Successful exploitation allows an unauthenticated attacker on the internal Wi-Fi network to fully control the Vision 60 robot, including accessing live camera feeds and issuing critical operational commands. This compromises confidentiality (exposure of video feeds), integrity (unauthorized command execution), and physical security (control over robot movements and emergency stop functions). The lack of authentication means no privileges are required to perform these actions, increasing the risk of misuse or malicious control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the internal Wi-Fi network to trusted users only to prevent unauthorized connections. Monitor network access and consider isolating the robot's network segment to reduce exposure. Avoid deploying the vulnerable app version 5.5.0 in untrusted environments.