{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aunitreego2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:unitree:go2:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-115995"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Unitree Go2 (\u003c= 1.1.11.4)"],"_cs_severities":["critical"],"_cs_tags":["iot","vulnerability","rce","hardware"],"_cs_type":"advisory","_cs_vendors":["Unitree Robotics"],"content_html":"\u003cp\u003eA security vulnerability has been identified in the Unitree Go2 (versions up to 1.1.11.4). The vulnerability exists in the set_volume function within the gpt_thread.py file of the chat_go component. Manipulating the 'Value' argument leads to OS command injection (CWE-78). The attack can be launched remotely. The vendor has confirmed the issue via internal ticket #474.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to version 1.1.11.5, which is sufficient to resolve this issue.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T00:27:09Z","date_published":"2026-10-25T00:27:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-unitree-go2-rce/","summary":"A security vulnerability in the Unitree Go2 component chat_go allows for remote OS command injection via the set_volume function.","title":"Unitree Robotics Unitree Go2: OS command injection in chat_go (CVE-2026-115995)","url":"https://feed.craftedsignal.io/briefs/2026-10-unitree-go2-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:unitree:go2:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}