Unitree Go2 (<= 1.1.11.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/unitree-go2--1.1.11.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 00:27:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnitree Robotics Unitree Go2: OS command injection in chat_go (CVE-2026-115995)https://feed.craftedsignal.io/briefs/2026-10-unitree-go2-rce/Sun, 25 Oct 2026 00:27:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-unitree-go2-rce/A security vulnerability in the Unitree Go2 component chat_go allows for remote OS command injection via the set_volume function.A security vulnerability has been identified in the Unitree Go2 (versions up to 1.1.11.4). The vulnerability exists in the set_volume function within the gpt_thread.py file of the chat_go component. Manipulating the 'Value' argument leads to OS command injection (CWE-78). The attack can be launched remotely. The vendor has confirmed the issue via internal ticket #474.

Recommendation

  • Upgrade to version 1.1.11.5, which is sufficient to resolve this issue.
]]>criticaladvisoryiotvulnerabilityrcehardware