Threat database

CVE-2026-115996 is a medium severity vulnerability in Unitree Robotics Unitree Go2 versions 1.1.0 through 1.1.15.1. It involves improper certificate validation in the WebSocketClient.connect function within the chat_go component, allowing remote attackers to potentially manipulate TLS server certificate validation. The attack complexity is high and exploitability is difficult. No official patch or remediation details are provided in the available data.

CVE-2026-115995 is a critical OS command injection vulnerability in Unitree Robotics Unitree Go2 versions 1.1.11.0 through 1.1.11.4. The flaw exists in the set_volume function within the gpt_thread.py file of the chat_go component, allowing remote attackers to execute arbitrary OS commands by manipulating the Value argument. Upgrading to version 1.1.11.5 resolves this issue.

Unitree Robotics G1 EDU firmware up to version 1.5.2 contains multiple chained vulnerabilities in its BLE GATT server and WiFi provisioning stack. These vulnerabilities allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable and a buffer overflow. The attack involves sending crafted BLE writes to overflow a fixed buffer, corrupting a function pointer that is later invoked with root privileges.

Unitree Robotics G1 EDU firmware up to version 1.5.2 contains a high-severity unauthenticated remote code execution vulnerability. This flaw involves a chain of three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key with world-readable permissions, and a path traversal vulnerability in the chat_go knowledge upload API. Exploiting these allows an attacker to execute arbitrary commands as root without authentication.