Medium severity6.6NVD Advisory· Published Mar 28, 2025· Updated Jun 17, 2026
CVE-2025-2894
CVE-2025-2894
Description
The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control over the affected robotic device using the CloudSail remote access service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:o:unitree:go1_firmware:-:*:*:*:*:*:*:*
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 2022_05_11_e0d0e617
Patches
Vulnerability mechanics
References
5- github.com/MAVProxyUser/YushuTechUnitreeGo1/blob/main/Unitree_report.pdfnvdExploitThird Party Advisory
- takeonme.org/cves/cve-2025-2894/nvdExploitMitigationThird Party Advisory
- github.com/unitreerobotics/unitree_ros/issues/120nvdIssue TrackingThird Party Advisory
- www.axios.com/2025/04/01/threat-spotlight-backdoor-in-chinese-robots-future-of-cybersecuritynvdPress/Media Coverage
- x.com/d0tslash/status/1730989109332607208nvdPress/Media Coverage
News mentions
1- FCC Blocks New Foreign-Produced Robots and Power Inverters Over Cyber RisksThe Hacker News · Jul 30, 2026