Undocumented CloudSail remote-access backdoor

1. Summary

Every Unitree Go1 quadruped robot ships with CloudSail, a third-party peer-to-peer NAT-traversing tunnel client (from China-based Oray/Zhexi Technology) that is pre-installed and auto-starts on boot on the robot’s onboard Raspberry Pi without the owner’s knowledge [1][4][5]. A single manufacturer-controlled CloudSail API key acts as the trust anchor for the entire registered fleet: any holder of that key can enumerate every registered device and open a tunnel to any of them [4][5]. Through that tunnel an attacker gains full remote control of the robot — issuing motion commands, viewing onboard cameras, and pivoting into the host LAN — with SSH access to the Pi available via default credentials pi/123 and a no-authentication web interface as additional footholds [4][6]. The flaw is classified CWE-912 (Hidden Functionality) and scored CVSS v3.1 6.6 MEDIUM [1][3].

2. Affected products & versions

3. The vulnerability in detail

The defect lives not in the robot’s application logic but in what the robot silently does the moment it powers on and reaches the internet. Inside every Go1 is a Raspberry Pi acting as the high-level compute board. On that Pi, under /usr/local/zhexi/cloudsail/, sits csclient, a client for the CloudSail service operated by the China-based company Oray / Zhexi Technology [4][5]. CloudSail is a commercial peer-to-peer, NAT-traversing tunnel product — conceptually similar to a reverse-tunnel or remote-access relay. On the Go1 it is wired into systemd as the CSClientDaemon unit and launches automatically on boot in both mode daemon and mode worker, opening a persistent outbound tunnel that dials home to unitree.com/CloudSail [4][5]. Because the connection is initiated outbound by the robot, standard perimeter defenses do not help: no inbound port needs to be open, and NAT or firewall filtering on the owner’s network does not prevent the robot from being reachable through the relay [1][5][6]. This is the core of the danger — the device makes itself reachable to the CloudSail control plane regardless of how the owner has secured their network.

The root cause is best understood as two compounding problems. First is the hidden functionality itself (CWE-912): the tunnel ships pre-installed, active, and undocumented, so an owner has no reason to know their robot maintains a live channel to a Chinese cloud service [4][5]. CWE-912 describes exactly this class of defect — functionality present in a shipped product that is not documented or expected by the user and that provides a capability (here, remote reachability and control) which subverts the user’s security assumptions. Second, and what turns “phones home” into “fully controllable by a stranger,” is the trust model: the entire fleet is keyed on a single shared manufacturer-controlled CloudSail API key [4][5]. That key is the universal trust anchor. Anyone who recovers it can query the CloudSail API to enumerate every registered device and its address, then request a tunnel to any chosen robot [4][5]. There is no per-device secret, no owner-scoped credential, and no user consent gating this access.

Once a tunnel to a target is open, the attacker’s capabilities are broad. They can send motion/locomotion commands to a ~12 kg walking machine, stream the onboard cameras, and use the robot as a pivot into whatever LAN it sits on [4][5][6]. Two further footholds deepen persistence and access: the onboard Pi accepts SSH with the default credentials pi/123, and there is a web interface exposed with no authentication [4][6]. So the same tunnel that grants control also yields a root-adjacent shell on a general-purpose Linux host inside the victim network.

The exploitation chain is linear and requires no physical proximity, no RF adjacency, and no inbound reachability [1][4]. (1) The Go1 boots with internet access and csclient auto-starts. (2) csclient opens the outbound P2P NAT-traversing tunnel to unitree.com/CloudSail. (3) The attacker obtains the shared CloudSail API key. (4) Using the key, they enumerate every registered device and IP through the CloudSail API — researchers observed 1,919 units historically connected [5][6]. (5) They open a tunnel to a chosen target. (6) They issue motion commands, view cameras, and pivot into the host LAN. (7) Optionally they SSH into the Pi with pi/123 or hit the no-auth web UI [4][6]. The only preconditions are a valid shared key, a target powered on with internet, and the affected firmware [4]. This maps to the NVD vector AV:N/AC:H/PR:H: network attack vector, but with “high privileges” reflecting that possession of the shared key is required, and “high complexity” reflecting the need to obtain/use that key rather than a trivially guessable input.

Proof-of-concept status: demonstrated. Researchers Andreas Makris and Kevin Finisterre recovered a shared key and showed live control and enumeration, documenting the full mechanism — a reproducible technique rather than released offensive tooling [4][5]. Telemetry showed 1,919 devices connected over time with roughly two active at the time of study, and the vendor subsequently revoked the exploited key [4][5].

4. Discovery & timeline

The backdoor was discovered by Andreas Makris (Bin4ry) and Kevin Finisterre (d0tslash) of Austin Hackers Anonymous (AHA!); Takeonme.org is the assigning CNA [4]. Timeline [4]:

• 2023-12-02 — initial vendor report to Unitree.
• 2025-03-21 — public disclosure by the researchers.
• 2025-03-23 — Unitree silently patched and revoked the exploited CloudSail API key.
• 2025-03-27 — official CVE disclosure (CVE-2025-2894).
• ~2025-04-01 — public reporting of the vulnerability as a supply-chain / national-security concern [5][6][7].

The vendor response was a silent fix: the key was revoked with no numbered fixed-firmware advisory, and the researchers noted the patch was applied quietly rather than accompanied by a coordinated bulletin [4].

5. Technical reference

• CVE: CVE-2025-2894 [1][2].
• CWE: CWE-912 (Hidden Functionality) [1][2][3].
• CVSS v3.1: 6.6 MEDIUM, vector AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, assigned by the Takeonme CNA [1][3]. Reading the vector for this bug: AV:N — reachable over the network via the CloudSail relay; AC:H — attacker must obtain and use the shared key; PR:H — that key functions as a high-privilege credential; UI:N — no owner interaction needed; S:U — scope unchanged in CVSS terms (notably, CVSS does not capture the LAN pivot or fleet-wide reach here); C:H/I:H/A:H — full confidentiality (cameras, LAN), integrity (motion commands, SSH), and availability impact. A researcher writeup showed 6.1, but NVD and GHSA both give 6.6 with an identical vector; 6.6 is authoritative [1][3].
• Code / paths: csclient under /usr/local/zhexi/cloudsail/, systemd unit CSClientDaemon, tunnel directory on the Pi; SSH pi/123; no-auth web UI; cloud API endpoint under unitree.com/CloudSail [4]. No commit hash (silent key revocation, not a code-diff fix).

6. Consequence & CFSE path analysis

Real-world consequence. A party holding one shared key could remotely walk, watch through, and network-pivot from any registered Go1 on the internet — a ~12 kg locomoting machine that in some deployments operates in prison, police, and military contexts, and in others sits on academic and corporate networks (MIT, Princeton, CMU, Waterloo among the 1,919 connected units) [5][6]. That spans physical-safety risk (dangerous actuation near bystanders), fleet-scale takeover keyed on a single trust anchor, and fleet-wide live camera/sensor surveillance with espionage implications.

Why the CFSE Path Score diverges from CVSS. CVSS lands this at 6.6 MEDIUM, largely because AC:H/PR:H (needing the key) discount the base and S:U ignores the two dimensions that actually matter here: that one shared key reaches the entire fleet, and that the outbound relay defeats perimeter defense entirely. CFSE decomposes the single CVE into distinct risk paths and scores each on real consequence and reachability, which is why the overall verdict rises to EMERGENCY.

CFSE verdict — EMERGENCY:

This analysis decomposes CVE-2025-2894 into three risk paths and assesses the record at EMERGENCY overall. Two co-dominant paths reach EMERGENCY: DEVICE_CONTROL_SAFETY (remote motion/locomotion commands plus SSH root on the onboard Raspberry Pi over the outbound CloudSail tunnel, creating dangerous-actuation/bystander-injury risk for a ~12kg walking quadruped, amplified by prison/police/military deployments) and FLEET_CONTROL_PLANE (a single shared CloudSail API key was reported to enumerate and control every registered robot — 1,919 devices — via a hidden cloud control plane keyed on one shared trust anchor). A third supporting path, PERCEPTION_PRIVACY, is banded CRITICAL (privacy-only cap): the same key enables fleet-wide live camera/sensor surveillance, raised as an espionage/national-security concern given academic and corporate networks (MIT, Princeton, CMU, Waterloo) among the connected units. All paths share RE:4 (robots auto-dial outbound to unitree.com CloudSail, bypassing NAT/firewall so reachable regardless of inbound filtering), EC:3 (reproducible once the shared key is held), fleet-wide recovery burden (OR:4), field confirmation (EV:4), and liveness MITIGATED (Unitree invalidated the exploited key and Go2+ changed architecture; the service can be disabled). Bands are uplifted from a CRITICAL base to EMERGENCY on the two dominant paths because one shared key reaches many registered robots and remediation requires coordinated fleet-wide firmware/service removal plus egress filtering.

7. Remediation & mitigations

Grounded in the disclosure and public guidance for this specific bug [4][6]:

• Disable the CloudSail tunnel on each Go1: systemctl disable CSClientDaemon and move the tunnel directory out of place (e.g., rename /usr/local/zhexi/cloudsail/ or move it to /root/tunnel_disabled) so the daemon cannot auto-start on boot [4][6].
• Network-isolate the robots from critical/sensitive networks so a compromised unit cannot pivot into corporate, academic, or operational LANs [6].
• Rotate the onboard SSH credentials — change the default pi/123 on the Raspberry Pi [4][6].
• Egress filtering — block/monitor outbound connections to CloudSail / unitree.com relay endpoints so the tunnel cannot re-establish; audit firewall and DNS logs for CloudSail connections as a detection signal [6].
• Vendor action already taken: Unitree revoked the exploited shared CloudSail API key ~2025-03-23, invalidating that specific key; note this is a mitigation of the disclosed key, not a documented firmware fix, so local disabling remains prudent [4].

8. Sources

[1] NVD - CVE-2025-2894 — NVD (NIST) — https://nvd.nist.gov/vuln/detail/CVE-2025-2894 — authoritative CWE-912 classification, CVSS 6.6 vector, and affected-product/firmware; primary-advisory. [2] CVE Record: CVE-2025-2894 — MITRE / CVE.org (Takeonme CNA) — https://www.cve.org/CVERecord?id=CVE-2025-2894 — canonical CNA record confirming CVE ID, product description, and CWE-912; primary-advisory. [3] GHSA-23cv-w96c-877f — GitHub Advisory Database — https://github.com/advisories/GHSA-23cv-w96c-877f — independent mirror confirming CVSS 6.6 Moderate and CWE-912 for cross-verification (affected/patched versions Unknown); primary-advisory. [4] CVE-2025-2894 — AHA! researcher writeup — Takeonme.org (Finisterre / Makris) — https://takeonme.org/cves/cve-2025-2894/ — original disclosure: CloudSail P2P tunnel, csclient/CSClientDaemon auto-start, recovered shared key, pi/123, no-auth web UI, remediation, timeline, key revocation; researcher-primary. [5] Undocumented Remote Access Backdoor Found in Unitree Go1 Robot Dog — SecurityWeek — https://www.securityweek.com/undocumented-remote-access-backdoor-found-in-unitree-go1-robot-dog/ — attacker capabilities, shared-key mechanism, unitree.com ping, 1,919 devices (~2 active), pre-installed/active without notice; reputable-press. [6] Remote Access Backdoor Discovered in Chinese Robot Dog Unitree Go1 — CyberInsider — https://cyberinsider.com/remote-access-backdoor-discovered-in-chinese-robot-dog-unitree-go1/ — confirms 1,919 units and affected institutions (MIT, Princeton, CMU, Waterloo), boot-integrated tunnel, no-auth UI/SSH default creds, isolation/rotation/disable/audit remediation; reputable-press. [7] Chinese robotics manufacturer left backdoor in product — Axios — https://www.axios.com/2025/04/01/threat-spotlight-backdoor-in-chinese-robots-future-of-cybersecurity — mainstream national-security / supply-chain framing; used for context only; reputable-press.