CVE-2023-3104: Missing Authentication for Critical Function in Unitree Robotics A1

Published Nov 22, 2023

Updated

Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication.

Affected Software

2 affected components

All of the following

Unitree A1 Firmware

Unitree A1=1.16

Remediation

Information

The affected robot is in the discontinuation stage. The manufacturer recommends changing the default network password, as well as disabling network functions if they are not required.

Event History

Nov 22, 2023

CVE Published

11:54 AM

Data Sourced

11:54 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2023-3104?

CVE-2023-3104 is a vulnerability that allows an unauthenticated local user to see through the cameras using the web server of Unitree Robotics A1 due to the lack of authentication.

How severe is CVE-2023-3104?

CVE-2023-3104 has a severity rating of 7.5, which is considered high.

What is the affected software of CVE-2023-3104?

The affected software of CVE-2023-3104 is Unitree A1 Firmware.

How can I fix CVE-2023-3104?

To fix CVE-2023-3104, it is recommended to apply the latest firmware updates provided by Unitree Robotics.

Where can I find more information about CVE-2023-3104?

More information about CVE-2023-3104 can be found at the following reference: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-unitree-robotics-a1