PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-27509 UnitreeRobotics CVE debrief

A critical remote code execution vulnerability affects Unitree Go2 quadruped robots running firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU). The root cause is the absence of DDS authentication and authorization on the Eclipse CycloneDDS topic `rt/api/programming_actuator/request`, which is processed by the `actuator_manager.py` service. A network-adjacent attacker can join DDS domain 0 without credentials and publish a crafted message with `api_id=1002` containing arbitrary Python code. The robot writes this payload to `/unitree/etc/programming/` and binds it to a physical controller keybinding. When triggered, the code executes with root privileges and persists across reboots. The CVSS 4.0 vector indicates adjacent network attack vector with low attack complexity, no privileges required, and high impact to confidentiality, integrity, and availability. This vulnerability was disclosed in February 2026 and modified in May 2026. No known exploitation in ransomware campaigns has been reported.

Vendor
UnitreeRobotics
Product
Unitree Go2
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-26
Original CVE updated
2026-05-26
Advisory published
2026-02-26
Advisory updated
2026-05-26

Who should care

Organizations deploying Unitree Go2 robots in enterprise, research, or critical infrastructure environments; robotics security teams; OT/IoT security practitioners; network administrators managing robot fleet connectivity

Technical summary

The Unitree Go2 robot runs Eclipse CycloneDDS with domain 0 exposed without authentication or authorization mechanisms. The `actuator_manager.py` component subscribes to `rt/api/programming_actuator/request` and processes messages containing api_id fields. When api_id=1002 is received, the message payload is written directly to disk at /unitree/etc/programming/ and registered as a controller keybinding script. The service executes these scripts as root when the physical keybinding is activated. The binding persists in firmware storage across reboots. An attacker with adjacent network access can craft and publish DDS messages to inject arbitrary Python code, achieving persistent root compromise without authentication.

Defensive priority

HIGH

Recommended defensive actions

  • Segment robot networks to prevent unauthorized DDS domain 0 access from adjacent networks
  • Implement network-level access controls restricting DDS traffic to authorized management hosts only
  • Monitor for unexpected file writes to /unitree/etc/programming/ directory
  • Audit controller keybindings for unauthorized Python script bindings
  • Apply vendor firmware updates when available addressing DDS authentication
  • Consider disabling programming_actuator service if functionality is not required
  • Deploy intrusion detection for anomalous DDS publish operations on rt/api/programming_actuator/request topic

Evidence notes

Vulnerability confirmed via NVD CPE criteria for Unitree Go2 firmware versions 1.1.7-1.1.9 and Go2 EDU firmware 1.1.11. Third-party advisory from VulnCheck and independent researcher disclosure provide technical details of the exploit mechanism. CWE-306 (Missing Authentication for Critical Function) classified as secondary weakness source.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-27509 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-27509

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-27509 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-27509

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.