Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Multiple vulnerabilities in Ghost Robotics' Vision 60

Posted date 17/10/2025
Identificador
INCIBE-2025-0574
Importance
5 - Critical
Affected Resources

Vision 60, version 0.27.2.

Description

INCIBE has coordinated the publication of three vulnerabilities, one critical and two high severity, affecting Ghost Robotics' Vision 60, a quadrupedal terrestrial robot designed to operate in complex environments with adverse conditions. The vulnerabilities were discovered by Adrián Campazas Vega and Claudia Álvarez Aparicio on the one hand, and by Pedro Cabrera Cámara, Miguel Gallego Vara and Javier Valero Martí from the company Ethonshield (CVE-2025-41108) on the other.

These vulnerabilities have been assigned the following codes, CVSS v4.0 base score, CVSS vector and CWE vulnerability type for each vulnerability:

  • CVE-2025-41108: CVSS v4.0: 9.2 | CVSS AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-287
  • CVE-2025-41109: CVSS v4.0: 8.7 | CVSS AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-798
  • CVE-2025-41110: CVSS v4.0: 7.0 | CVSS AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-287
Solution

No solution has been reported at this time.

Detail
  • CVE-2025-41108: the communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack station, impersonating the control station (tablet) and gaining unauthorised full control of the robot. The absence of encryption and authentication mechanisms in the communication protocol allows an attacker to capture legitimate traffic between the robot and the controller, replicate it, and send any valid command to the robot from any attacking computer or device. The communication protocol used in this interface is based on MAVLink, a widely documented protocol, which increases the likelihood of attack. There are two methods for connecting to the robot remotely: Wi-Fi and 4G/LTE.
  • CVE-2025-41109: Ghost Robotics Vision 60 v0.27.2 includes, among its physical interfaces, three RJ45 connectors and a USB Type-C port. The vulnerability is due to the lack of authentication mechanisms when establishing connections through these ports. Specifically, with regard to network connectivity, the robot's internal router automatically assigns IP addresses to any device physically connected to it. An attacker could connect a WiFi access point under their control to gain access to the robot's network without needing the credentials for the deployed network. Once inside, the attacker can monitor all its data, as the robot runs on ROS 2 without authentication by default.
  • CVE-2025-41110: encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK. This vulnerability allows an attacker to connect to the robot's WiFi and view all its data, as it runs on ROS 2 without default authentication. In addition, the attacker can connect via SSH and gain full control of the robot, which could cause physical damage to the robot itself or its environment.
CVE
Explotación
No
References list
Vision 60 - Ghost Robotics
Etiquetas