Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models. This issue appears to affect all of Unitree’s current offerings as of February 26, 2026, and so should be considered a vulnerability in both the firmware generation and extraction processes. At the time of this release, there is no publicly-documented mechanism to subvert the update process and insert poisoned firmware packages without the equipment owner’s knowledge.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 14 products
| Date | Total | Labels |
|---|
| 2026-02-27 | 4 | Disclosure3Exploit1 |
| 2026-03-04 | 2 | Disclosure1PoC1 |
Tonight i publish UniTeaBag, live from AHA. CVE-2026-1442. Everyone can now decrypt and encrypt Unitree Firmware packages. Enjoy :) https://github.com/Bin4ry/UniTEABag
Post summary
The post announces the release of UniTeaBag, a publicly available tool that exploits CVE‑2026‑1442 to decrypt and encrypt Unitree firmware packages, with code hosted on GitHub.
CVE-2026-1442: @UnitreeRobotics UPK files Hard-Coded Key https://takeonme.org/cves/cve-2026-1442/ by @Bin4ryDigit. Big thanks to @todb of @AustinHackers https://t.co/PRTFf4amwj
Post summary
A tweet announces CVE‑2026‑1442 involving hard‑coded keys in UnitreeRobotics UPK files, linking to a write‑up but providing no PoC, exploit code, or patch details.
CVE-2026-1442 (published Feb 2026, posted by d0tslash): Hardcoded TEA encryption key in Unitree UPK firmware files. Derived from fixed constants in OTA binary + file seed. Anyone can decrypt payload, tamper (e.g. insert backdoors), re-encrypt, recompute MD5 sig, and push "valid" updates. Affects all current models (Go2, G1 humanoids, etc.). PoC: UniTEABag GitHub repo. Firmware pwn city.
Post summary
CVE-2026-1442 reveals a hardcoded TEA key in Unitree firmware, enabling attackers to decrypt, modify, and re‑sign updates. A PoC repository (UniTEABag) demonstrates the exploit, but no active exploitation or patch is reported.
CVE-2026-1442 (CVSS:7.8, HIGH) is Undergoing Analysis. Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an a..https://nvd.nist.gov/vuln/detail/CVE-2026-1442 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
CVE-2026-1442 is under analysis; it involves a flaw in the encryption of firmware updates, with a CVSS score of 7.8.
CVE-2026-1442 Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmwa… https://www.cve.org/CVERecord?id=CVE-2026-1442
Post summary
The CVE points out that the encryption algorithm protecting firmware updates relies on key material that attackers can obtain, exposing the updates to decryption. No PoC, exploit code, active exploitation, or patch details are mentioned.
CVE-2026-1442 Firmware Update Encryption Bypass Vulnerability in Unitree Go2 and Product Line https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1442
Post summary
The entry announces CVE-2026-1442, a firmware update encryption bypass vulnerability affecting Unitree Go2 products, without providing PoC, exploit details, or patch information.
14 of 14 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | unitree | go1_air | - | - | - |
| OS | unitree | go1_air_firmware | - | - | - |
| HW | unitree | go1_pro | - | - | - |
| OS | unitree | go1_pro_firmware | - | - | - |
| HW | unitree | go2_air | - | - | - |
| OS | unitree | go2_air_firmware | - | - | - |
| HW | unitree | go2_edu_plus | - | - | - |
| OS | unitree | go2_edu_plus_firmware | - | - | - |
| HW | unitree | go2_edu_standard | - | - | - |
| OS | unitree | go2_edu_standard_firmware | - | - | - |
| HW | unitree | go2_pro | - | - | - |
| OS | unitree | go2_pro_firmware | - | - | - |
| HW | unitree | go2_x | - | - | - |
| OS | unitree | go2_x_firmware | - | - | - |