A critical OS command injection vulnerability in Unitree robotic devices allows unauthenticated attackers to gain root access and execute arbitrary system commands.

The flaw exists in the hostapd_restart.sh script, where the wifi_ssid and wifi_pass parameters are improperly neutralized before being processed by the system. This allows an unauthenticated attacker, with network access to the device, to inject malicious OS commands.

The ability for an attacker to achieve root level code execution on robotic hardware presents a severe operational and safety risk. A successful exploit could lead to complete loss of device control, unauthorized access to sensitive sensor data, and potential physical safety hazards in the environment where the robot operates. With a CVSS score of 8.2, this vulnerability is classified as High severity due to the potential for total system compromise.

Immediate Action: Contact Unitree support or monitor the official vendor portal for the release of a security patch that addresses the command injection vulnerability in the hostapd_restart.sh script.

Proactive Monitoring: Review system logs for unusual process execution patterns or modifications to wireless configuration files.

Compensating Controls: Restrict network access to the affected devices by placing them on isolated management VLANs and implementing firewall rules to prevent unauthorized access to the wireless configuration interfaces.

Public Exploit Available: Yes, a public proof-of-concept exists via the UniPwn GitHub repository.

Given the availability of public proof-of-concept code and the high-impact nature of root command injection, administrators must prioritize the isolation of these devices from untrusted networks. While a direct vendor patch remains pending, implementing strict network segmentation is essential to mitigate the risk of unauthorized remote exploitation.