CVE-2020-16167
📋 TL;DR
This vulnerability allows remote attackers to intercept and answer video calls intended for other temi robot users, granting them unauthorized motor control and audio/video access. It affects temi Robox OS versions before 120 and temi Android app versions up to 1.3.7931. Attackers can exploit this without authentication to take control of robots.
💻 Affected Systems
- temi Robox OS
- temi Android app
📦 What is this software?
Launcher Os by Robotemi
⚠️ Risk & Real-World Impact
Worst Case
Complete remote takeover of temi robots allowing physical movement control, audio/video surveillance, and potential physical damage or privacy violations.
Likely Case
Unauthorized access to robot controls and audio/video feeds, enabling surveillance and limited physical movement.
If Mitigated
No unauthorized access possible with proper authentication controls in place.
🎯 Exploit Status
Exploitation involves intercepting and answering calls via unspecified vectors, requiring network access to the robot.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Robox OS 120 or later, Android app newer than 1.3.7931
Vendor Advisory: https://www.robotemi.com/software-updates/
Restart Required: Yes
Instructions:
1. Update temi Robox OS to version 120 or later via robot settings. 2. Update temi Android app to latest version from Google Play Store. 3. Restart the robot after OS update.
🔧 Temporary Workarounds
Disable remote call functionality
allTemporarily disable the call feature that allows remote connections to the robot.
Network segmentation
allIsolate temi robots on separate network segments with strict firewall rules.
🧯 If You Can't Patch
- Disconnect robots from internet and use only on isolated internal networks
- Disable all remote access features including call functionality in robot settings
🔍 How to Verify
Check if Vulnerable:
Check Robox OS version on robot display (Settings > About) and Android app version in app settings.Check Version:
On robot: Settings > About > Version. On Android: App Info > Version.Verify Fix Applied:
Confirm Robox OS version is 120 or higher and Android app version is newer than 1.3.7931.📡 Detection & Monitoring
Log Indicators:
- Unauthorized call connections
- Multiple failed authentication attempts on call system
- Unexpected motor control commands
Network Indicators:
- Unusual network traffic to/from temi robots
- Call interception patterns
- Unauthorized remote connections
SIEM Query:
source="temi_robot" AND (event="call_intercepted" OR event="unauthorized_access")