Multiple vulnerabilities in Unitree Robotics A1
Posted date 21/11/2023
Identificador
INCIBE-2023-0511
Importance
4 - High
Affected Resources
Unitree Robotics A1, 1.16 version.
Description
INCIBE has coordinated the publication of 2 vulnerabilities affecting Unitree Robotics A1 1.16, which have been discovered by Alberto Miguel Diez and Adrián Campazas Vega from the Robotics Group of the University of León.
These vulnerabilities has been assigned the following code, CVSS v3.1 base score, CVSS vector string, and CWE vulnerability type:
- CVE-2023-3103: CVSS v3.1: 8.0 | CVSS: AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CWE-290.
- CVE-2023-3104: CVSS v3.1: 5.7 | CVSS: AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | CWE-306.
Solution
The affected robot is in the discontinuation stage. The manufacturer recommends changing the default network password, as well as disabling network functions if they are not required.
Detail
- CVE-2023-3103: authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera video stream. In addition, if a MITM attack is carried out, it is possible to consume the robot's resources, which could lead to a denial-of-service (DOS) condition.
- CVE-2023-3104: lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication.
Etiquetas
