CVE-2025-35027

Deeper analysis

CVE-2025-35027 is a command injection vulnerability present in multiple Unitree robotic platforms, including the Go2, G1, H1, and B2 models. These devices share a common firmware base derived from the MIT Cheetah codebase, with the primary forks being the G1 humanoid and Go2 quadruped branches. The flaw resides in the handling of WiFi configuration strings received over the on-board BLE module; when a malicious value is supplied and the WiFi service is subsequently restarted, the wpa_supplicant_restart.sh script executes the attacker-controlled input as root.

An attacker with adjacent-network access and limited privileges can exploit the issue by writing a crafted string through the BLE interface and forcing a WiFi service restart. Successful exploitation grants the ability to run arbitrary commands as root, resulting in full control over confidentiality and integrity of the affected robot while leaving availability unaffected. The CVSS 7.3 score reflects the low attack complexity and the absence of required user interaction.

Public references, including proof-of-concept material at github.com/Bin4ry/UniPwn and coverage at spectrum.ieee.org and takeonme.org, document the vulnerability but do not detail vendor-supplied patches or configuration workarounds in the provided sources.

EPSS scores for the CVE rose from a low baseline to a recorded peak of 0.0104, indicating measurable exploitation interest after disclosure.