Overview
CVE-2025-60017 is a critical vulnerability that affects a range of Unitree devices including the Go2, G1, H1, and B2 models. This vulnerability allows for root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass parameter, potentially leading to system compromise or data leakage. The nature of this vulnerability can cause significant security risks, especially in environments where these devices are deployed in abundance. The severity of this issue is further emphasized by its high CVSS severity score of 8.2, indicating its potential for severe impact if exploited.
Vulnerability Summary
CVE ID: CVE-2025-60017
Severity: High (8.2 CVSS score)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Unitree Go2 | All versions up to 2025-09-20
Unitree G1 | All versions up to 2025-09-20
Unitree H1 | All versions up to 2025-09-20
Unitree B2 | All versions up to 2025-09-20
How the Exploit Works
The exploitation process begins when an attacker sends a specially crafted request containing malicious commands to the hostapd_restart.sh script through the wifi_ssid or wifi_pass parameter. This parameter is involved in the restart_wifi_ap and restart_wifi_sta functions of the devices. Due to insufficient input validation, the malicious commands are executed with root privileges leading to the compromise of the device.
Conceptual Example Code
Here is a hypothetical example of how the vulnerability might be exploited. The malicious payload is injected into the wifi_ssid parameter in a POST request:
POST /restart_wifi_ap HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "wifi_ssid": "; rm -rf /" }In this example, if the system executes the wifi_ssid value as a command, it would delete all files in the system, rendering it inoperable.
Note: This example is purely conceptual and demonstrates the potential impact of this vulnerability. Please do not execute this command as it will cause severe damage to the system.
Mitigation Guidance
Users of the affected Unitree devices are recommended to apply the vendor-supplied patch as soon as possible. In the absence of a patch or until one can be applied, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) could be used as a temporary measure to mitigate the risk associated with this vulnerability. These solutions can detect and block malicious requests containing the exploit.
