Public disclosure
Reported by Andreas Makris aka Bin4ry; coordinated by todb (CVE record credits).
Security advisory
Unitree UPK firmware-update format uses hardcoded cryptographic keys
The CNA identifies hardcoded cryptographic keys in Unitree's UPK firmware-update format, with a component range through 20260226v1. It describes apparent applicability across Unitree offerings as of February 26, 2026 but gives no model-specific firmware range. The researcher's disclosure lists G1 firmware packages; this entry retains the CVE's UPK component scope. The CNA reports no documented method of inserting modified updates without the owner's knowledge.
Records last verified Oct 13, 2026 · Send a correction
- CVE IDs
- CVE-2026-1442
- Class
- Hardcoded Credentials
- CVSS / assessor
- 7.8 · CVSS 3.1 · Austin Hackers Anonymous CNA
- Vendor response
- Unknown
Affected models, versions and components
- Unitree UPK firmware-update formatComponent scope; individual models not established
UPK format through 20260226v1; no model-specific firmware range stated by the CNA
Component: UPK firmware generation and extraction
Disclosure and response timeline
The record has one response or remediation date. It does not supply separate dates for every vendor communication and fix.
Vendor response / remediation update (as recorded)
Date not stated
Unknown. The CNA and researcher say the vendor was not notified. No vendor response or fixed UPK format is identified in these disclosures.
Fix
Separate fix date not recorded
No fixed version identified in the recorded sources.
What owners should do
No owner-facing recommendation is recorded in the primary disclosure. Consult the cited advisory and vendor support for guidance on your exact configuration.
Fixed version (as stated): No fixed version identified.
The CNA and researcher say the vendor was not notified. No vendor response or fixed UPK format is identified in these disclosures.
How to read this ledger
We include official CVE records, vendor advisories, CERT/CISA notices and researchers’ own disclosures. CVSS is attributed to its published assessor, including the named CVE Numbering Authority (CNA), with the version from the recorded vector. A CNA score is not an NVD assessment. An unpublished score stays unknown.
Affected versions, variants, component scope and fix qualifications retain the disclosure’s wording. A reported patch is not an independent retest. Disputed findings show the researcher and vendor positions together. We publish no exploit instructions or payloads.
Counts describe curated advisory records; several records may come from one disclosure. Coverage is incomplete and is not a security ranking. An absent record does not establish that a robot has no vulnerabilities.
Evidence
Sources
- [s1] CVE-2026-1442 — CVE Program record ↗
CVE Program / Austin Hackers Anonymous CNA · database · published Feb 27, 2026 · accessed Oct 13, 2026
- [s2] CVE-2026-1442: Unitree UPK files Hard-Coded Key ↗
Austin Hackers Anonymous · other · published Feb 26, 2026 · accessed Oct 13, 2026
- [s3] UniTEABag — researcher disclosure of the Unitree UPK firmware format ↗
Andreas Makris (Bin4ry) · other · accessed Oct 13, 2026
Other advisory records
- Unitree G1 EDU BLE provisioning and buffer handling allow root code execution →
- Unitree G1 EDU remote code execution through DDS bridge and file upload →
- Unitree G1 and H1 access-point configuration command injection →
- Unitree G1 and H1 BLE provisioning handshake authentication bypass →
- Unitree G1 and H1 BLE provisioning uses shared cryptographic secrets →
- Unitree G1 and H1 Wi-Fi configuration command injection →
- Unitree G1 telemetry privacy findings disputed by the manufacturer →
Trackers
Task evidence →
Source statements, stated autonomy and demonstration conditions.
Deployments →
Customers, tasks, contracts and evidence grades.
Timelines →
Dated maker claims, targets and sourced outcomes.
Policy →
Market access, legislation and standards in context.
How many robots →
Estimates, definitions, capacity and forecasts.