A critical remote code execution vulnerability in Unitree Go2 firmware allows unauthenticated attackers to gain root access to the robot through manipulation of the DDS communication protocol.

The firmware fails to implement authentication or authorization for the Eclipse CycloneDDS topic used by the actuator manager. An unauthenticated, network-adjacent attacker can inject arbitrary Python code into a message that the robot subsequently writes to the local filesystem and executes with root privileges upon a physical controller keybinding event.

Successful exploitation grants an attacker full administrative control over the Unitree Go2 robot. This poses a significant risk of physical safety hazards, unauthorized data exfiltration, and the potential for persistent backdoors to be installed on the device. Given the CVSS score of 8.0, this represents a high-severity threat that could lead to complete system compromise and loss of operational integrity.

Immediate Action: Update the Unitree Go2 firmware to version 1.1.13 or the latest available release provided by the vendor.

Proactive Monitoring: Monitor network traffic for unauthorized access to DDS domain 0 and audit system logs for unexpected file modifications within the /unitree/etc/programming/ directory.

Compensating Controls: Isolate the robot from untrusted or public networks using VLANs or firewall rules to restrict network-adjacent access to the DDS interface.

Public Exploit Available: Yes, a detailed technical write-up containing a functional proof-of-concept exists at the boschko.ca research blog.

This vulnerability presents a severe risk to the operational security of the Unitree Go2 platform. Administrators must prioritize the application of the V1.1.13 firmware update to close the insecure DDS communication channel. If immediate patching is not possible, strict network segmentation is required to prevent unauthenticated network-adjacent access to the device.