https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-1442.htmlhttps://patchthecve.com/cve/CVE-2026-1442.htmlWed, 17 Jun 2026 10:15:47 +0000HIGH 7.8: Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models. https://patchthecve.com/cve/CVE-2026-27510.htmlhttps://patchthecve.com/cve/CVE-2026-27510.htmlWed, 17 Jun 2026 10:27:16 +0000CRITICAL 9.6: Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLithttps://patchthecve.com/cve/CVE-2026-27509.htmlhttps://patchthecve.com/cve/CVE-2026-27509.htmlWed, 17 Jun 2026 10:27:16 +0000HIGH 8.0: Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publhttps://patchthecve.com/cve/CVE-2025-35027.htmlhttps://patchthecve.com/cve/CVE-2025-35027.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.3: Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. By setting a malicious string when configuring the on-board WiFi via a BLE module of an affected robot, then triggering a restart of the WiFi service,https://patchthecve.com/cve/CVE-2025-45466.htmlhttps://patchthecve.com/cve/CVE-2025-45466.htmlWed, 17 Jun 2026 09:25:31 +0000HIGH 8.8: Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext.https://patchthecve.com/cve/CVE-2025-45467.htmlhttps://patchthecve.com/cve/CVE-2025-45467.htmlWed, 17 Jun 2026 09:25:31 +0000HIGH 7.1: Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an insecure verification mechanism that solely relies on MD5 checksums for firmware integrity validation.https://patchthecve.com/cve/CVE-2025-2894.htmlhttps://patchthecve.com/cve/CVE-2025-2894.htmlWed, 17 Jun 2026 09:07:48 +0000MEDIUM 6.6: The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control over the affected robotic device using the CloudSail