CVE-2026-12990
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
An access control vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics Vision 60 robot allows multiple simultaneous sessions without client validation. An attacker with a modified app can connect during an active session.
Risk Assessment
An attacker can intercept sensitive data (e.g., live video) and partially control the robot without the operator's knowledge, compromising confidentiality and operational security.
Recommendation
Implement session validation and restrict to one active session at a time.
Other vulnerabilities in Ghost Robotics Vision 60
See all- CVE-2026-12991High
Lack of cryptographic mechanisms in Ghost Robotics Vision 60 robot (APK v5.5.0) enables man-in-the-middle attacks. An attacker on the local network can intercept and manipulate communications between the operator and the robot.
- CVE-2026-12989High
Lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics Vision 60 robot allows an unauthenticated attacker on the Wi-Fi network full access to the web admin interface and HTTP API.
Original NVD description (English source)
An access control vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active, legitimate session. This allows the attacker to bypass control restrictions, intercept sensitive information (such as real-time video), and partially interact with the system unnoticed and without disconnecting the legitimate user, compromising confidentiality and operational security.