When robots get hacked: what researchers have published about Unitree firmware flaws

Researchers have published three main sets of security findings about Unitree robots: a hidden remote-access tunnel on the Go1 robot dog (March 2025), the UniPwn Bluetooth exploit giving root control of Go2, B2, G1 and H1 robots (September 2025), and undisclosed telemetry from the G1 humanoid. At events, the shared question is who else can control the robot.

This article covers what the public records say: the CVE entries in the US National Vulnerability Database (NVD), the researchers' own advisories, two papers on arXiv and reporting by IEEE Spectrum. It does not cover undisclosed or unconfirmed claims.

Why robot firmware security is different

A hacked laptop can leak data. A hacked robot can do that too, and it can also move. Legged robots carry cameras, microphones, depth sensors and motors, and most of them connect to Wi-Fi, Bluetooth and the manufacturer's cloud services. If someone gets into the software that controls the motors, the problem is no longer only about IT. It becomes a physical safety issue.

The CVE system gives each publicly disclosed vulnerability an identifier and, in the NVD, a severity score (CVSS) from 0 to 10. The score also records the attack vector: whether an attacker needs network access from anywhere, needs to be on an adjacent network such as a nearby radio link, or needs physical access. This detail matters for events, where robots work in crowded halls full of strangers' phones.

The Go1 remote-access tunnel (CVE-2025-2894)

The NVD describes CVE-2025-2894, published on 28 March 2025, as an undocumented backdoor in the Unitree Go1 robot dog. It ran through a tunnelling service called CloudSail, and anyone with the right API key, including the manufacturer, could get full access to an affected robot. The entry lists Go1 firmware version 2022_05_11_e0d0e617 and gives a score of 6.6 (medium). The score is held down by the requirement for high privileges, meaning possession of that key.

The researchers' advisory on the Go1 backdoor explains that CloudSail, a peer-to-peer tunnelling product from the company Oray, started automatically on the robot's onboard computer at boot. Tunnelling services of this kind are built to reach devices behind firewalls and home routers. The advisory says this exposed both the robot and the network it was connected to, without the owner knowing.

The advisory's timeline says a suspected backdoor was first raised with Unitree in December 2023. Public disclosure came on 21 March 2025, and Unitree invalidated the access token within days. The researchers called this fix incomplete, because a new token could in principle reopen the same channel. Their suggested mitigation is to disable the service by hand, which requires terminal access using the robot's default login. A default password is a weakness in its own right.

UniPwn: Bluetooth to root on Go2, B2, G1 and H1

In September 2025 researchers Andreas Makris and Kevin Finisterre published an exploit called UniPwn. IEEE Spectrum reported that it affected the Go2 and B2 quadrupeds and the G1 and H1 humanoids. These are some of the models most often seen at trade shows and stage events.

The weakness sits in the Bluetooth Low Energy (BLE) interface that owners use to set up the robot's Wi-Fi. According to IEEE Spectrum, the authentication relied on encryption keys that were hardcoded in the firmware, so anyone who extracted them could pass the check. After that, an attacker could put commands into the Wi-Fi network name or password fields, and the robot would run them with root (full administrator) rights. The magazine also said the flaw was wormable: a compromised robot could go on to infect other Unitree robots within wireless range.

The NVD lists several connected entries, published on 26 September 2025:

• CVE-2025-35027: command injection through the Wi-Fi setup script, scored 7.3 (high), listing Go2 and B2 firmware up to 1.1.8 and G1 and H1 firmware up to 1.4.4.
• CVE-2025-60017: a related root command injection through a second network script, scored 8.2 (high), for devices running firmware up to 20 September 2025.
• CVE-2025-60250 and CVE-2025-60251, which the researchers' advisory describes as a bypassed Bluetooth authentication check and a hardcoded authentication secret.

The NVD scores for the command injection flaws have an an adjacent attack vector. An attacker has to be within Bluetooth or local network reach, not anywhere on the internet. That limits who can attack, but it does not reassure event organisers much, because at a public event anyone in the audience is within reach.

Disclosure timeline and Unitree's response

The researchers' advisory for CVE-2025-35027 says they first contacted Unitree in May 2025. In July, according to the advisory, the company indicated that fixes could take a long time. The researchers went public on 20 September 2025. They added that on 7 October 2025 they confirmed that recent updates had not fixed the issue.

IEEE Spectrum reported a statement Unitree posted on 29 September 2025. In it the company said it was working on security and network issues, had completed most of the fixes, and would release updates soon. We could not find a public, version-by-version list showing which firmware releases fix each CVE. Organisers should therefore not assume a robot is patched just because it was updated recently. Ask the supplier which firmware the unit is running and what has changed.

Telemetry from the G1 humanoid

Also in September 2025, two papers on arXiv looked more closely at the G1. In The Cybersecurity of a Humanoid Robot, Víctor Mayoral-Vilches describes a proprietary encryption scheme that relies on static keys, which made it possible to decrypt the robot's configuration offline. The paper also reports telemetry connections that sent sensor data, including audio, video, spatial and actuator data, to external servers with no explicit consent or notice to the user.

The companion paper, Cybersecurity AI: Humanoid Robots as Attack Vectors, by Mayoral-Vilches, Makris and Finisterre, says the G1 sent telemetry to two external IP addresses every 300 seconds without telling the operator. The authors argue this conflicts with GDPR requirements. Their paper also shows a software agent running on a compromised robot being used to map the manufacturer's cloud infrastructure.

Two cautions apply. arXiv papers are preprints and have not necessarily been peer reviewed. The GDPR point is the authors' own analysis, not a ruling by a regulator. Even so, any data a robot collects at an event, and where that data goes, is something the organiser may need to account for to visitors. Our guide to cameras, microphones and visitor privacy covers the basics. This article is general information, not legal advice.

What the findings do and do not show

The published research shows that attackers within wireless range could take control of several popular Unitree models, and that a Go1 had a remote tunnel its owners were not told about. The CVE entries and papers do not report any attack carried out against a robot at a real event, and we found no public report of one.

The findings also do not mean other manufacturers are safe. They show what independent researchers have looked at and published so far. Other robots have received less public scrutiny, which tells us nothing about how secure they are. New EU rules will put more formal security duties on connected products over the coming years. Our explainer on the Cyber Resilience Act and the Radio Equipment Directive explains what they require and when.

What this means for event organisers

• Ask about firmware and patches. Include in your brief a request for the firmware version and a statement on how the supplier handles published vulnerabilities such as the Unitree CVEs. Our guide on what to put in a request to a robot supplier shows where this fits.
• Ask how the robot is connected. Find out whether it uses Bluetooth setup, a cloud app, or its own access point, and whether unused wireless interfaces are switched off during the show. Agree network arrangements with the venue in advance, using the venue checklist for space, power and Wi-Fi.
• Keep a human in charge. An operator who stays with the robot, an emergency stop within reach and a clear safety zone limit the damage from any failure, whether it is caused by software or by an attack. See safety at public events with robots.
• Ask where the data goes. Ask whether camera, audio or telemetry data leaves the robot during your event, and to which servers. Use the answer in your privacy notice.
• Treat model pages as a starting point. Specifications such as those on the Unitree Go2 page describe the hardware. They do not tell you how a particular unit has been configured or patched.

Frequently asked questions

Which Unitree robots were affected by the UniPwn vulnerability?

IEEE Spectrum and the NVD entries list the Go2 and B2 quadrupeds and the G1 and H1 humanoids. CVE-2025-35027 names Go2 and B2 firmware up to version 1.1.8 and G1 and H1 firmware up to 1.4.4. Related entries cover devices running firmware up to 20 September 2025. Ask your supplier which firmware a specific unit runs.

Can someone hack a robot dog over the internet?

It depends on the flaw. The UniPwn vulnerabilities have an adjacent attack vector, so the attacker has to be within Bluetooth or local network range. The Go1 CloudSail tunnel, CVE-2025-2894, allowed remote access over the network to anyone with the correct API key. At public events, being within wireless range is easy, so the adjacent limit protects less than it might seem.

Has Unitree fixed these vulnerabilities?

Unitree said on 29 September 2025 that it had completed most of the fixes and would release updates. The researchers said on 7 October 2025 that recent updates had not resolved the issue. We found no public list matching firmware versions to fixed CVEs, so the current status of a particular robot should be confirmed with the supplier.

Does the G1 humanoid send data to external servers?

Two arXiv preprints from September 2025 report that the G1 they examined sent telemetry to external servers every 300 seconds without notifying the operator, and that this data included sensor and service information. These are research findings, not regulatory decisions. Organisers should ask suppliers what data leaves the robot during an event.

How this article was made: written by the humanoid4rent editorial team with AI assistance; every factual statement was checked against the sources listed below on 2026-11-01. Spotted an error? Write to info@humanoid4rent.com.