Unitree Go1 Incorrect Access Control Vulnerability Allowing Remote Code Execution

A vulnerability exists in the Unitree Go1 robotic dog, specifically in all versions through Go1_2022_05_11. The issue stems from hardcoded plaintext authentication credentials, which create incorrect access control. This vulnerability allows remote or local attackers to gain unauthorized access to the robot via SSH or SCP. Exploitation of this flaw could lead to remote code execution, privilege escalation, and information disclosure.

Impact

Exploitation of this vulnerability allows for remote code execution with root privileges on the affected device.

Reproduction

To reproduce this vulnerability, download the affected firmware version Go1_2022_05_11. Extract the firmware and inspect the run.sh script for hardcoded plaintext credentials. These credentials can be used to SSH into the robot as the root user. Once logged in, full control over the robot with root permissions is granted.