CVE-2025-45467
📋 TL;DR
This vulnerability allows attackers to upload malicious firmware to Unitree Go1 robots by exploiting insecure MD5 checksum verification. Attackers can compromise robot functionality, potentially gaining unauthorized control. All Unitree Go1 robots running firmware versions up to Go1_2022_05_11 are affected.
💻 Affected Systems
- Unitree Go1 robot
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of robot control allowing physical damage, surveillance, or weaponization of the robot against people or property.
Likely Case
Unauthorized firmware modification leading to robot malfunction, data theft, or disruption of operations.
If Mitigated
Limited impact if network segmentation prevents attacker access to firmware update interfaces.
🎯 Exploit Status
Exploitation requires network access to the robot's update interface but no authentication. MD5 collision attacks are well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.unitree.com/cn/go1
Restart Required: Yes
Instructions:
1. Monitor Unitree website for firmware updates. 2. When available, download official firmware. 3. Apply update via secure connection. 4. Verify using SHA-256 or stronger checksum.
🔧 Temporary Workarounds
Network Segmentation
allIsolate robot network from untrusted networks to prevent attacker access to firmware update interface.
Disable Remote Updates
allDisable Wi-Fi/Ethernet firmware update functionality if not required for operations.
🧯 If You Can't Patch
- Implement strict network access controls to robot management interfaces
- Monitor for unauthorized firmware update attempts and MD5 checksum anomalies
🔍 How to Verify
Check if Vulnerable:
Check robot firmware version via Unitree control interface. If version is Go1_2022_05_11 or earlier, system is vulnerable.Check Version:
Check via Unitree robot control panel or API (specific command depends on deployment)Verify Fix Applied:
After applying any official patch, verify firmware uses SHA-256 or stronger checksum validation for updates.📡 Detection & Monitoring
Log Indicators:
- Unexpected firmware update attempts
- MD5 checksum validation failures
- Unauthorized network connections to robot update port
Network Indicators:
- Traffic to robot firmware update ports (typically 80/443) from unauthorized sources
- MD5 hash transfers in firmware update communications
SIEM Query:
source_ip NOT IN (authorized_ips) AND dest_port IN (80,443) AND dest_ip IN (robot_ips) AND protocol='http' AND uri CONTAINS 'firmware'