CVE-2026-12991 describes a vulnerability in Ghost Robotics Vision 60 robot (APK v5.5.0) where the absence of cryptographic mechanisms to ensure communication integrity and authenticity allows attackers on the local network to perform man-in-the-middle attacks. By leveraging ARP spoofing and selective traffic blocking, an attacker can intercept and alter packets between the legitimate operator and the robot, disconnect the original controller, and establish unauthorized control. This results in a serious compromise of confidentiality, integrity, and availability of the robot's operations. The vulnerability is classified under CWE-300 (Channel Accessible by Non-Endpoint). No official patch or remediation is currently available.

An attacker on the same local network can intercept and manipulate communications between the operator and the Vision 60 robot, leading to unauthorized control takeover. This compromises the confidentiality of commands, the integrity of communications, and the availability of the robot to the legitimate operator. The CVSS 4.0 score is 8.7 (high severity), reflecting the significant risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, operators should restrict network access to trusted devices only and monitor for suspicious ARP activity on the local network to reduce exposure. No official fix or temporary workaround has been published by the vendor at this time.