📄 Description (English)
Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pressed, the code executes as root and the binding persists across reboots.
🤖 AI Executive Summary
Unitree Go2 robot firmware versions V1.1.7-V1.1.9 and V1.1.11 (EDU) contain a critical authentication bypass vulnerability in Eclipse CycloneDDS that allows unauthenticated network-adjacent attackers to execute arbitrary Python code as root. An attacker can inject malicious code via crafted DDS messages that persist across reboots through physical controller keybindings. This vulnerability poses significant risk to organizations deploying these robots in sensitive environments, particularly in research institutions and industrial automation settings within Saudi Arabia.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: Apr 26, 2026 20:36
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability primarily impacts Saudi research institutions, universities (KAUST, King Saud University), and industrial automation facilities deploying Unitree Go2 robots. Secondary impact on government research centers and private sector robotics labs. The persistent nature of the exploit (surviving reboots) and root-level execution capability make this particularly dangerous for organizations in critical infrastructure research, manufacturing automation, and advanced technology development sectors. Organizations in the Kingdom's Vision 2030 technology initiatives and industrial automation programs are at elevated risk.
🏢 Affected Saudi Sectors
Research & Development
Higher Education
Industrial Automation
Manufacturing
Government Research Centers
Technology Innovation Hubs
Robotics Development
🎯 MITRE ATT&CK Techniques
T1190 - Exploit Public-Facing Application (DDS service exploitation)
T1021 - Remote Services (DDS network access)
T1059 - Command and Scripting Interpreter (Python code execution)
T1547 - Boot or Logon Autostart Execution (persistent keybinding mechanism)
T1548 - Abuse Elevation Control Mechanism (root-level execution)
T1578 - Modify Cloud Compute Infrastructure (robot configuration modification)
T1105 - Ingress Tool Transfer (malicious code injection)
⚖️ Saudi Risk Score (AI)
8.5
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Identify all Unitree Go2 robots in your environment and document their firmware versions
2. Isolate affected robots (V1.1.7-V1.1.9, V1.1.11 EDU) from network access until patched
3. Implement network segmentation: restrict DDS domain 0 access to trusted networks only
4. Monitor for suspicious DDS traffic on port 7400-7410 (CycloneDDS default ports)
PATCHING GUIDANCE:
1. Apply available firmware patches immediately to all affected Unitree Go2 units
2. Verify patch installation by confirming firmware version post-update
3. Test robot functionality after patching in isolated environment before production deployment
COMPENSATING CONTROLS (if patching delayed):
1. Implement network-level DDS authentication using firewall rules
2. Deploy DDS traffic inspection and anomaly detection
3. Restrict physical access to robot keybindings
4. Monitor /unitree/etc/programming/ directory for unauthorized file creation
5. Implement file integrity monitoring on robot filesystem
DETECTION RULES:
1. Alert on DDS messages to rt/api/programming_actuator/request with api_id=1002
2. Monitor for Python file creation in /unitree/etc/programming/ directory
3. Track unexpected keybinding modifications in robot configuration
4. Log all DDS domain 0 join events from non-whitelisted sources
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. حدد جميع روبوتات Unitree Go2 في بيئتك وقثق إصدارات البرامج الثابتة الخاصة بها
2. عزل الروبوتات المتأثرة (V1.1.7-V1.1.9، V1.1.11 EDU) عن الوصول إلى الشبكة حتى يتم إصلاحها
3. تنفيذ تقسيم الشبكة: تقييد الوصول إلى مجال DDS 0 للشبكات الموثوقة فقط
4. مراقبة حركة DDS المريبة على المنافذ 7400-7410 (منافذ CycloneDDS الافتراضية)
إرشادات التصحيح:
1. تطبيق تصحيحات البرامج الثابتة المتاحة فوراً على جميع وحدات Unitree Go2 المتأثرة
2. التحقق من تثبيت التصحيح بتأكيد إصدار البرامج الثابتة بعد التحديث
3. اختبار وظائف الروبوت بعد التصحيح في بيئة معزولة قبل نشر الإنتاج
الضوابط البديلة (إذا تأخر التصحيح):
1. تنفيذ مصادقة DDS على مستوى الشبكة باستخدام قواعد جدار الحماية
2. نشر فحص حركة DDS والكشف عن الشذوذ
3. تقييد الوصول الفيزيائي إلى ربط مفاتيح الروبوت
4. مراقبة دليل /unitree/etc/programming/ لإنشاء ملفات غير مصرح بها
5. تنفيذ مراقبة سلامة الملفات على نظام ملفات الروبوت
قواعد الكشف:
1. تنبيه على رسائل DDS إلى rt/api/programming_actuator/request مع api_id=1002
2. مراقبة إنشاء ملف Python في دليل /unitree/etc/programming/
3. تتبع تعديلات ربط المفاتيح غير المتوقعة في تكوين الروبوت
4. تسجيل جميع أحداث انضمام مجال DDS 0 من مصادر غير مدرجة في القائمة البيضاء
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.5.1.1 - Access Control Policies (DDS authentication/authorization missing)
ECC 2024 A.5.2.1 - User Registration and Access Management (unauthenticated access)
ECC 2024 A.5.3.1 - Management of Privileged Access Rights (root code execution)
ECC 2024 A.8.2.1 - User Access Management (network-adjacent unauthorized access)
ECC 2024 A.12.4.1 - Event Logging (DDS traffic monitoring required)
🔵 SAMA CSF
SAMA CSF ID.AM-1 - Asset Management (inventory of affected robots)
SAMA CSF PR.AC-1 - Access Control (DDS authentication implementation)
SAMA CSF PR.AC-3 - Access Enforcement (restrict DDS domain access)
SAMA CSF DE.CM-1 - Detection Processes (monitor DDS anomalies)
SAMA CSF RS.MI-2 - Incident Response (containment procedures)
🟡 ISO 27001:2022
ISO 27001:2022 A.5.2 - Information Security Policies (access control policy)
ISO 27001:2022 A.6.2 - Internal Organization (responsibility for vulnerability management)
ISO 27001:2022 A.8.1 - Asset Management (robot asset inventory)
ISO 27001:2022 A.8.3 - Media Handling (firmware update procedures)
ISO 27001:2022 A.9.1 - Access Control (authentication/authorization)
ISO 27001:2022 A.12.6 - Technical Vulnerability Management (patch management)