CVE-2026-1442 json
Unitree UPK files Hard-Coded Key
published 2026-02-27 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-8994
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 6%
- public exploits
- 0
- none known
Summary
Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models. This issue appears to affect all of Unitree’s current offerings as of February 26, 2026, and so should be considered a vulnerability in both the firmware generation and extraction processes. At the time of this release, there is no publicly-documented mechanism to subvert the update process and insert poisoned firmware packages without the equipment owner’s knowledge.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 8 mo ago
Exploit prediction
0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/Bin4ry/UniTEABag referenced PoC, tagged "exploit" by a source, unverified
- takeonme.org http://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000001111111111110101111111111000000000000000000000000000000000000000000000000000000101 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
- Unitree UPK
Classification
- Weakness
-
- CWE-321 Use of Hard-coded Cryptographic Key
References
-
github.com
/Bin4ry/UniTEABag
exploit, third-party-advisory
-
takeonme.org
/gcves/GCVE-1337-2025-0000000000000000000000000000000000000000000000000111111111111010111111111100000000000000
third-party-advisory, exploit
-
linkedin.com
/posts/kevin-finisterre-6431069a_in-case-you-want-to-teabag-unitree-robotics-activity-7432984361014091776-zB4D
related, third-party-advisory
-
x.com
/bin4rydigit/status/2027197985625420242
related, third-party-advisory
Sources
- CVE List CVE-2026-1442
- NVD CVE-2026-1442
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.