CVE-2025-45466
📋 TL;DR
Unitree Go1 robots with firmware up to Go1_2022_05_11 have hardcoded authentication credentials in plaintext, allowing attackers to bypass authentication and gain unauthorized access. This affects all users of affected Unitree Go1 robot models.
💻 Affected Systems
- Unitree Go1 robot
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of robot control allowing physical manipulation, data theft, or disabling of safety features
Likely Case
Unauthorized access to robot systems enabling surveillance, data collection, or limited control functions
If Mitigated
Limited impact if network segmentation and access controls prevent external connections
🎯 Exploit Status
Exploitation requires network access to robot but uses publicly known hardcoded credentials
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.unitree.com/cn/go1
Restart Required: Yes
Instructions:
1. Contact Unitree for updated firmware
2. Apply firmware update
3. Change all default credentials
4. Restart robot
🔧 Temporary Workarounds
Network segmentation
allIsolate robot on separate network segment with strict firewall rules
Credential rotation
allManually change hardcoded credentials if firmware allows
🧯 If You Can't Patch
- Disconnect robot from network when not in use
- Implement strict network access controls and monitoring
🔍 How to Verify
Check if Vulnerable:
Check firmware version via robot interface or console, verify if <= Go1_2022_05_11Check Version:
Check robot control interface or manufacturer documentation for version commandVerify Fix Applied:
Verify firmware version > Go1_2022_05_11 and test authentication with default credentials fails📡 Detection & Monitoring
Log Indicators:
- Authentication attempts with default credentials
- Unauthorized access patterns
Network Indicators:
- Connections to robot using known hardcoded credentials
- Unexpected robot network traffic
SIEM Query:
source_ip=* AND (username="default" OR password="hardcoded_value")