CVE-2026-115996
LowCVSS 3.7Summary
A vulnerability was detected in Unitree Robotics Unitree Go2 up to versions 1.1.13/1.1.14.1/1.1.15.1. The WebSocketClient.connect function in websocket.py of the chat_go component performs improper certificate validation, enabling a remote attack of high complexity. The vendor confirmed the issue (CWE-295).
Risk Assessment
Improper TLS server certificate validation may allow an attacker to intercept or impersonate WSS communication, compromising data confidentiality and integrity. Exploitation is difficult but remotely possible.
Recommendation
Apply the vendor fix or upgrade to a version where TLS certificate validation works correctly. Also verify the WSS client configuration enforces certificate validation.
Other vulnerabilities in Unitree Go2 chat_go
Original NVD description (English source)
A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS