Executive brief
The mobile application used to control Ghost Robotics' Vision 60 quadruped robot lacks authentication for its administrative interface and API. This allows anyone connected to the robot's internal Wi-Fi network to take full control of the device, including viewing live camera feeds, manipulating sensors like GPS and LIDAR, and executing movement or emergency stop commands. Such an exploit poses a significant risk to physical safety and operational security, as an unauthorized person could hijack the robot's functions or spy on its surroundings.
Technical details
The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) within the Vision 60 mobile application (APK v5.5.0). The application fails to enforce authentication or authorization checks for its web administration interface and underlying HTTP API. An attacker positioned on the robot's internal Wi-Fi network (Adjacent vector) can interact directly with these services without credentials. This provides unrestricted access to telemetry, sensor data (LIDAR, GPS), real-time video streams, and operational controls (movement, E-Stop). As of the advisory date, no official patch or solution has been reported.
Affected products
- Ghost Robotics Vision 60 robot (mobile app) 5.5.0 (APK)
Timeline
- 2026-07-27: disclosed: Coordinated disclosure by INCIBE-CERT
- 2026-07-27: advisory: NVD record published