The way in is the volume control
A critical vulnerability in Unitree’s Go2 quadruped robot was published to the US National Vulnerability Database on 24 October. The flaw is not in the robot’s motion control, its cameras or its network stack. It is in set_volume, a function in a file called gpt_thread.py, inside the component Unitree calls chat_go — the robot’s conversational assistant.
According to the NVD entry, manipulating the function’s Value argument “leads to os command injection.” The weakness is classified as CWE-78, improper neutralisation of special elements used in an OS command: the volume figure is passed somewhere that treats it as a shell command rather than as a number.
The entry says the attack “can be launched remotely.”
The scores
The flaw carries three severity scores, all at or near the top of their scales. Under CVSS 3.1 it is rated 9.6, critical, with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Under the newer CVSS 4.0 it is rated 9.4, also critical. Under the long-superseded CVSS 2.0 it is a flat 10.0.
Two parts of the 3.1 vector carry most of the weight. PR:N means no privileges are required. S:C means the scope changes — the exploited component and the impacted component are not the same, which on a robot means the chat process is not where the damage stops. The one mitigating element is UI:R: user interaction is required, which CVSS 4.0 records as UI:P, passive interaction.
Versions, and the fix
The NVD record covers Unitree Go2 firmware “up to 1.1.11.4.” Version 1.1.11.5 resolves it, and the entry states plainly: “Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component.”
The referenced firmware package is named for the Go2 Edu, Max, Pro and X variants, and is served from an Alibaba Cloud object store.
The vendor confirmed it, with a ticket number
Unusually for a database entry, the NVD description quotes the manufacturer directly. “The vendor confirmed early,” it says, before quoting: “Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78).”
That is a vendor naming its own internal ticket, the component, the function and the weakness class in one sentence. It is a more complete acknowledgement than most hardware vendors give, and it removes any ambiguity about whether the finding was disputed. The coordinating record is held by VulDB as entry 426093, under submission 990502.
Why this class of bug keeps appearing
The Go2 is sold in education and research configurations, which is how a research-grade quadruped ends up on university networks and in company labs rather than behind an industrial firewall. The chat feature is the part most likely to be exposed, because being reachable is the point of it.
The underlying pattern is older than the robot. A natural-language front end has to turn what it is told into parameters for the system underneath, and every parameter that reaches a shell without being neutralised is a command injection waiting to be found. A volume setting is about as low-stakes as a parameter gets, which is presumably why it was not treated as dangerous input.
What to watch
There is no public evidence in the record that the flaw has been exploited, and the fix is a firmware update that already exists. The question is how many deployed Go2 units take it. Robots in teaching labs are updated on a schedule set by whoever runs the lab, not by a fleet manager, and a robot that is working is a robot nobody wants to take offline.
Worth watching too is whether other vendors’ assistant integrations get the same scrutiny. chat_go is a thin conversational layer bolted onto a machine that moves, and the same architecture is now on a great many devices.
