CVE-2025-60017
HIGH
8.2
CVSS Score
Published: September 26, 2025 at 12:00 AM UTC
Updated: October 18, 2026 at 09:10 PM UTC
4 products affected across 1 vendorGo2B2G1
Using Go2 by Unitree?
Get instant alerts when new vulnerabilities affect Go2 - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.2
Exploit prediction
EPSS 1%
SSVC
PoC
Description
Unitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass parameter (within restart_wifi_ap and restart_wifi_sta).
Remediation
No guide yetNo remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.
References (3)
Source: cverecord
https://spectrum.ieee.org/unitree-robot-exploitSource: cverecord
https://github.com/Bin4ry/UniPwnSource: cverecord
https://news.ycombinator.com/item?id=45381590SSVC — Action Prioritization
SSVCPoCAutomatableTotal impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
8.2HIGHmitre
Vector?
Quick Info
StatusDEFERRED
CWE
CWE-78
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card