Unitree Robots Under Fire đŸ”„

Research & Techniques
, , , ,
1

Just before sun come out, I wanted to share some research on Unitree which were funny to read.

Robot ‘goes berserk
Robot ‘goes berserk440×247 41.1 KB

(This animation was chosen for the fun
)

In just a few months, multiple independent research teams have published critical vulnerabilities covering the entire attack surface: from BLE to firmware updates to DDS inter-process communication.

UniPwn: wormable BLE command injection (Sept 2025)

The researchers found a chain of vulnerabilities in the BLE Wi-Fi configuration service exposed by all affected models:

  • Hardcoded AES-CFB128 keys: same key and IV across every single device,
  • Trivial authentication: the “handshake” is just sending the string "unitree" encrypted with the known key,
  • Command injection via system(): the Wi-Fi SSID/password fields are passed unsanitized into shell commands with root privileges.

The vulnerability is wormable. An infected robot can scan for other Unitree robots in BLE range and compromise them autonomously, creating a self-propagating robot botnet with zero user interaction.

Here you can find the repo: GitHub - Bin4ry/UniPwn

UniTEABag: firmware encryption broken (Feb 2026)

Following UniPwn, Bin4ry went after the firmware update mechanism. Unitree uses a custom firmware format called UPK, encrypted with TEA (Tiny Encryption Algorithm): a symmetric cipher from the best years → 1990s “Hack the Planet!”

The problems:

  • Hardcoded key constants in the OTA binary on the robot itself,
  • Seed stored inside the UPK package: combined with the constants, anyone can derive the full TEA key,
  • No signature verification: the robot has no way to distinguish genuine Unitree firmware from a crafted package.

UniTEABag can both decrypt existing firmware (enabling analysis) and encrypt custom firmware that the robot will accept as genuine. Two key generation versions are supported, covering different robot generations.

Repo: GitHub - Bin4ry/UniTEABag

DDS-Based RCE: from network packets to RCE (Feb 2026)

olivier_boschko images
olivier_boschko images680×384 40.9 KB

This research targets a completely different attack surface: DDS (Data Distribution Service), the publish-subscribe middleware the Go2 uses for internal inter-process communication via Eclipse CycloneDDS.

  • CVE-2026-27509: On firmware V1.1.7, the rt/api/programming_actuator/* DDS topic accepts arbitrary Python code for execution. Since DDS has no authentication in the default configuration, any device on the same network can join domain 0 and publish messages to this topic, achieving unauthenticated RCE as root.

  • CVE-2026-27510: On V1.1.11, the exposed DDS topics were suppressed as a fix. But the researchers found an alternative path: by tampering with the Blockly preprogrammed action blocks stored in the Android companion app’s local SQLite database, they could inject code that gets executed when a controller keybinding is pressed — making the RCE persistent.

Link: Unitree Go2 Robot RCE (CVE-2026-27509 & CVE-2026-27510)