BLE Wi-Fi configuration root takeover

1. Summary

The Bluetooth Low Energy (BLE) Wi-Fi configuration service in Unitree’s shared “common firmware” — running on the Go2 and B2 quadrupeds and the G1 and H1 humanoids — can be reached by any attacker within radio range without credentials or user interaction [1][5]. The service protects its packets with an AES key and IV that are identical on every device, and its handshake accepts any secret merely containing the substring unitree, so an attacker can forge valid encrypted packets and reach an “authenticated” state at will [3][4][5]. From that state, attacker-supplied Wi-Fi SSID/password fields are concatenated unescaped into a sudo-invoked shell command and executed via system, giving unauthenticated root command execution over the air [1][6]. Because the cryptographic material is device-invariant, a compromised robot can autonomously scan for and infect in-range peers, making the exploit wormable [5][8].

2. Affected products & versions

All shipping firmware versions were reported vulnerable at disclosure [1][5]. MITRE-scored companion CVEs express the boundary as Go2/G1/H1/B2 devices “through 2025-09-20.” No effective fixed build is documented; updates observed as of 2025-10-07 were reported ineffective [6].

3. The vulnerability in detail

UniPwn is a single, coherent attack surface — the BLE Wi-Fi configuration service — that is broken at three layers simultaneously, and the three defects compose into a clean path from radio adjacency to root. All four models share the same “common firmware,” so the same primitives work identically across quadrupeds and humanoids [1][5][8].

Where the flaw lives. The vulnerable code is the BLE Wi-Fi configuration GATT service exposed under service UUID 0000ffe0-0000-1000-8000-00805f9b34fb with write characteristic 0000ffe2-0000-1000-8000-00805f9b34fb, together with the shell scripts it ultimately invokes: wpa_supplicant_restart.sh and hostapd_restart.sh, both in /unitree/module/network_manager/upper_bluetooth/ [5][6]. This service exists so an operator can push Wi-Fi credentials to a robot over Bluetooth before it has a network. It is, by design, reachable pre-authentication over the air — which is precisely why the auth and crypto weaknesses below are so damaging.

Root cause — three compounding defects.

1. Hardcoded, device-invariant crypto (CWE-321, CVE-2025-60250). BLE packets are protected with AES-CFB128 using key df98b715d5c6ed2b25817b6f2554124a and IV 2841ae97419c2973296a0d4bdfe19a4f. These constants are baked into the firmware and are the same on every unit shipped [3][5]. Anyone who extracts them once (they are now public) can decrypt and forge traffic to any device. The encryption therefore provides no confidentiality and no integrity against an informed attacker; it is effectively obfuscation with a published key.

2. Missing authentication via a substring check (CWE-306, CVE-2025-60251). The handshake that is supposed to authenticate the peer simply sets an internal valid_incoming_user flag if the decrypted payload contains the plaintext string unitree [4][5]. There is no challenge/response, no nonce, no cryptographic proof of identity — a literal substring match stands in for authentication. Combined with defect (1), the attacker can construct a correctly encrypted packet whose plaintext contains unitree and be treated as an authenticated user.

3. OS command injection via unsanitized Wi-Fi fields (CWE-78, CVE-2025-35027 / CVE-2025-60017) — the core defect. Once “authenticated,” the attacker submits Wi-Fi configuration. The firmware takes the attacker-controlled SSID and password strings and concatenates them, without sanitization or shell-metacharacter escaping, into a command of the form:

sudo sh /unitree/module/network_manager/upper_bluetooth/wpa_supplicant_restart.sh "wifi_ssid wifi_pass"

(and the analogous hostapd_restart.sh path). That string is handed to system. Because the SSID/password are interpolated directly into a shell command that runs under sudo, any shell metacharacters the attacker embeds are interpreted by the shell as root [1][5][6].

The classic weakness here is CWE-78, OS Command Injection: user-controlled input crosses into a shell interpreter without the special characters (;, $, `, &, |, #, quotes) being neutralized. The robot intends the field to be an opaque SSID; the shell reads it as code. Because the enclosing command is already privileged (sudo sh...), the injected code inherits root — there is no additional privilege step to climb.

Mechanism and trigger. The whole chain runs over BLE against the config service. The attacker AES-CFB128-encrypts an instruction with the known key/IV so the firmware will accept and decrypt it; the decrypted payload contains unitree, flipping valid_incoming_user with no real proof of identity [5]. In the now-authenticated session the attacker sends the Wi-Fi config instructions, placing a payload such as ";$(reboot -f);# into the SSID (or password) field. When the device later builds the sudo command from those fields and runs it via system, the injected $(...) executes as root [5]. Preconditions are minimal: BLE radio adjacency (Adjacent / AV:A); no credentials, no prior access, and no user interaction (the hardcoded key and substring handshake defeat authentication entirely); and affected common firmware present, which at disclosure meant every shipping version [5].

Step-by-step exploitation chain [1][5][6]:

1. Move within BLE range of a target Go2, B2, G1, or H1 and connect to the Wi-Fi config GATT service (service UUID 0000ffe0-…, write characteristic 0000ffe2-…).
2. Encrypt an instruction using the hardcoded AES-CFB128 key df98b715d5c6ed2b25817b6f2554124a and IV 2841ae97419c2973296a0d4bdfe19a4f (CVE-2025-60250) so the firmware will decrypt attacker packets.
3. Send a handshake packet whose decrypted payload contains unitree, setting valid_incoming_user and granting authenticated state (CVE-2025-60251).
4. Optionally send the get-serial-number instruction to confirm access, then select AP/STA Wi-Fi mode.
5. Send the SSID-configuration instruction with an injection payload such as ";$(reboot -f);# in place of a legitimate SSID, then set an arbitrary password (CVE-2025-35027 / CVE-2025-60017).
6. Send the trigger instruction (e.g. set country code) that spawns the Wi-Fi thread, causing the firmware to build and system-execute sudo sh.../wpa_supplicant_restart.sh "wifi_ssid wifi_pass" — the injected $(...) runs as root.
7. With root, deploy a payload that scans BLE for other in-range Unitree robots and reuses the identical key and unitree handshake to compromise them, self-propagating into a robot botnet.

Note: the ordered instruction sequence above is documented in the PoC writeup [5], but the exact numeric instruction/opcode values for each configuration step are not enumerated in the available sources.

Proof-of-concept status. A public, working PoC exists in the Bin4ry/UniPwn GitHub repository — a Python-based BLE exploit framework plus a documented Android APK — with the exact key/IV, handshake string, injection payloads, and command paths disclosed [5]. A functional PoC payload was created on 2025-04-25 by Konstantin Severov, and the PoC demonstrates wormable self-propagation [5].

4. Discovery & timeline

The chain was discovered and disclosed by Andreas Makris (Bin4ry), Kevin Finisterre (h0stile), and Konstantin Severov [5][6]. CVE-2025-35027 was coordinated through the CNA Austin Hackers Anonymous (AHA!, takeonme.org); the other three CVEs are MITRE-scored [1][6].

• 2025-04-14 — Discovery (Makris, Finisterre) [5].
• 2025-04-25 — First working PoC payload (Severov) [5].
• 2025-05-14 — Initial vendor contact via LinkedIn/GitHub [5].
• 2025-05-28/29 — Unitree created security@unitree.com [5].
• 2025-06-08 — Vendor claimed an existing Go1 patch, with minimal engagement [5].
• 2025-07-18/26 — Communication deteriorated; vendor cited multi-quarter/multi-year fix timelines and stopped responding after its R1 launch [5].
• 2025-09-20 — Public disclosure on GitHub [5].
• 2025-09-26 — CVE-2025-35027 published [1][6].
• 2025-10-07 — Updates reported ineffective per takeonme [6].

The researchers described the vendor response as minimal — no meaningful remediation timeline, and declined requests for debug builds or loaner hardware — and characterized it as their first and last responsible-disclosure attempt with Unitree [5][9].

5. Technical reference

• CVE-2025-35027 — OS Command Injection (CWE-78) via BLE Wi-Fi config; CVSS 3.1 base 7.3 HIGH, vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; CNA Austin Hackers Anonymous [1][6].
• CVE-2025-60017 — OS Command Injection (CWE-78) via hostapd_restart.sh wifi_ssid/wifi_pass; CVSS 3.1 base 8.2 HIGH, vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H, Scope Changed; CNA MITRE [2].
• CVE-2025-60250 — Use of Hard-coded Cryptographic Key (CWE-321); decrypting BLE packets with key df98b715… and IV 2841ae97…; CVSS 3.1 base 4.7 MEDIUM, vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N; CNA MITRE [3].
• CVE-2025-60251 — Missing Authentication for Critical Function (CWE-306); accepts any handshake secret containing unitree; CVSS 3.1 base 5.0 MEDIUM, vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L; CNA MITRE [4].

What the key metrics mean here. Every CVE carries AV:A (Adjacent) — the attack requires BLE radio proximity, not internet reachability, which is the single most important scope-limiter and the reason base scores land in HIGH rather than CRITICAL. The two command-injection CVEs disagree on attack complexity: CVE-2025-35027 is AC:L (the AHA! scoring, treating the chain as reliably reproducible) while CVE-2025-60017 is AC:H and PR:N with S:C (MITRE modeling the sudo-privilege crossing as a scope change with higher complexity). S:C on CVE-2025-60017 reflects that injected code escapes the vulnerable component’s authority boundary and runs as OS root. Notably, no single per-CVE base vector captures the compounded reality — unauthenticated (PR:N) root with full C/I/A impact — because CVSS scores each weakness in isolation rather than the chain.

• Code/commit refs — no vendor patch commit is documented. PoC and exact primitives are published in Bin4ry/UniPwn [5]; the vulnerable command path and script names are given in the AHA! advisory [6].

6. Consequence & CFSE path analysis

Real-world consequence. A person standing within Bluetooth range of a Unitree robot — no credentials, no app, no touching the machine — can execute arbitrary commands as root. That means full control of a walking quadruped or humanoid: its motion stack, its onboard sensors (camera, microphone, LIDAR, spatial map), and its ability to reach and infect other robots nearby. The concrete outcomes range from bricking/rebooting a unit, to covert surveillance, to driving a physically capable machine near bystanders, to seeding a self-spreading robot botnet across a fleet.

Why the CFSE Path Score diverges from CVSS. CVSS scores each weakness in isolation and tops out at HIGH (7.3–8.2), anchored by AV:A. CFSE instead scores the consequence of the composed chain reaching real capabilities in this system, and models authority and exploitation explicitly. The entry decomposes UniPwn into three consequence paths, all rooted in the same BLE-proximity unauthenticated root primitive (hardcoded shared AES key + trivial unitree string auth + sudo command injection via the Wi-Fi config script):

• PERCEPTION_TO_ACTION — band CRITICAL. Root reaches the motion stack of a walking quadruped/humanoid whose onboard perception (LIDAR/camera/spatial map) feeds its own actuation, creating a credible physical hazard to bystanders.
• PERCEPTION_PRIVACY — band CRITICAL. The same root exposes live camera, microphone, LIDAR, and spatial-map data for surveillance/exfiltration (privacy-only, no physical effect).
• FLEET_CONTROL_PLANE — dominant path, uplifted to EMERGENCY. A CRITICAL base is uplifted because the exploit is wormable: a compromised robot autonomously scans BLE and reuses the shared key to infect in-range peers, forming a self-spreading robot botnet. Recovery requires fleet-wide firmware remediation, since any unpatched in-range peer can re-seed propagation.

Authority is modeled as AT3 (OS/service root — not vendor signing/OTA root) throughout, and exploitation is EV3 (reproduced/documented with a public PoC, not confirmed exploited in the wild). The overall path_verdict is EMERGENCY, driven by the fleet-control-plane path.

Verdict: EMERGENCY.

7. Remediation & mitigations

No effective vendor patch is documented at disclosure, and updates observed as of 2025-10-07 were reported ineffective [6]. Mitigations grounded in the specific defects:

• Attack surface — Disable or restrict the BLE Wi-Fi configuration service, and keep robots out of untrusted BLE radio range, since adjacency is the only precondition [5].
• Fix the crypto (CWE-321) — Replace the hardcoded, device-invariant AES key/IV with per-device keys and real cryptographic authentication, eliminating the ability to forge valid packets from published constants [3][5].
• Fix the handshake (CWE-306) — Replace the unitree-substring check with genuine challenge/response authentication so a substring can no longer stand in for identity [4][5].
• Fix the injection (CWE-78) — Sanitize/escape or, preferably, avoid shell interpolation of Wi-Fi SSID/password inputs entirely: pass them as safely-quoted arguments to wpa_supplicant_restart.sh/hostapd_restart.sh rather than concatenating them into a sudo shell string, and drop privileges where possible [5][6].
• Fleet-wide, not per-device — Because propagation re-seeds from any unpatched in-range peer, remediation must cover the entire fleet simultaneously; patching individual units leaves them re-infectable by neighbors [5].

Specific vendor-issued fix steps are not documented in the available sources.

8. Sources

• [1] NVD — CVE-2025-35027 (Unitree common-firmware command injection via BLE Wi-Fi config) — NVD / NIST — https://nvd.nist.gov/vuln/detail/CVE-2025-35027 — authoritative record for the core command-injection CVE: affected models, Adjacent AV, CVSS 7.3, PoC/press references. Credibility: primary-advisory.
• [2] NVD — CVE-2025-60017 — NVD / NIST — https://nvd.nist.gov/vuln/detail/CVE-2025-60017 — MITRE-scored OS command-injection component via hostapd_restart.sh; CVSS 8.2, Scope Changed (the entry’s headline high-severity baseline). Credibility: primary-advisory.
• [3] NVD — CVE-2025-60250 — NVD / NIST — https://nvd.nist.gov/vuln/detail/CVE-2025-60250 — MITRE-scored hardcoded-key weakness (CWE-321), CVSS 4.7 MEDIUM. Credibility: primary-advisory.
• [4] NVD — CVE-2025-60251 — NVD / NIST — https://nvd.nist.gov/vuln/detail/CVE-2025-60251 — MITRE-scored missing-authentication weakness (CWE-306, the unitree substring bypass), CVSS 5.0 MEDIUM. Credibility: primary-advisory.
• [5] Bin4ry/UniPwn — original researcher writeup and proof-of-concept — Andreas Makris (Bin4ry), Kevin Finisterre (h0stile), Konstantin Severov — https://github.com/Bin4ry/UniPwn — the primary source: exact AES key/IV, unitree handshake bypass, shell-metacharacter injection payloads, wormable self-propagation, affected models, and the full disclosure timeline. Credibility: researcher-primary.
• [6] AHA! (takeonme.org) — CVE-2025-35027 advisory — Austin Hackers Anonymous (CNA/discoverer) — https://takeonme.org/cves/cve-2025-35027/ — the publishing CNA’s page: the concrete vulnerable command path (sudo sh.../wpa_supplicant_restart.sh "wifi_ssid wifi_pass"), the CVSS 7.3 vector, discoverer credits, and the note that 2025-10-07 updates were ineffective. Credibility: researcher-primary.
• [7] GitHub Advisory Database — GHSA-27p8-m7h9-xchc (CVE-2025-35027) — GitHub Advisory Database — https://github.com/advisories/GHSA-27p8-m7h9-xchc — curated advisory restating affected products, CVSS 7.3, the BLE-to-root mechanism via wpa_supplicant_restart.sh, an EPSS estimate, and consolidated references. Credibility: primary-advisory.
• [8] IEEE Spectrum — Unitree robot exploit (UniPwn) — IEEE Spectrum — https://spectrum.ieee.org/unitree-robot-exploit — reputable technical-press analysis framing UniPwn as the first major public exploit of a commercial humanoid platform; explains the keys, handshake, unsanitized concatenation, and wormable consequence. Credibility: reputable-press.
• [9] Digitimes — Critical Bluetooth flaw exposes Unitree robots to root-level takeover — Digitimes — https://www.digitimes.com/news/a20250926VL204/bluetooth-wi-fi-robot-security.html — independent corroboration of the BLE-to-root takeover, affected models, wormable propagation, and disclosure timeline/vendor response. Credibility: reputable-press.