CVE-2026-12989: Ghost Robotics Vision 60 Auth Bypass Flaw

CVE-2026-12989 Overview

CVE-2026-12989 is a missing authentication vulnerability in the Ghost Robotics Vision 60 quadruped robot mobile application (APK v5.5.0). An attacker connected to the robot's internal Wi-Fi network can reach the web administration interface and HTTP API without providing credentials. The flaw is classified under [CWE-306] Missing Authentication for Critical Function.

Successful exploitation grants unrestricted control of the robot. An attacker can view live camera feeds, manipulate GPS, RTK, SAM, and LIDAR sensors, and issue operational commands including Play, Pause, Stop, and E-Stop. The vulnerability affects the confidentiality, integrity, and physical safety of the platform.

Critical Impact
An unauthenticated adjacent-network attacker can seize full control of the Vision 60 robot, hijack movement, and access real-time sensor and camera data.

Affected Products

Ghost Robotics Vision 60 robot
Vision 60 mobile application APK version 5.5.0
Vision 60 web administration interface and HTTP API

Discovery Timeline

2026-07-27 - CVE-2026-12989 published to the National Vulnerability Database
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-12989

Vulnerability Analysis

The Vision 60 exposes a web administration interface and an HTTP API through its internal Wi-Fi network. Both endpoints handle privileged robot operations, including motion control, sensor management, and emergency stop commands. Neither surface enforces authentication or authorization before processing requests.

Any device that associates with the robot's Wi-Fi network can query the API directly. The application relies on network reachability as its only trust boundary. This is a canonical case of [CWE-306] Missing Authentication for Critical Function.

The attack is limited to adjacent-network access, but the internal Wi-Fi radius provides a practical exploitation window in field deployments. An attacker within radio range can enumerate endpoints and invoke commands that alter physical behavior.

Root Cause

The mobile application and its supporting services trust any client on the robot's internal wireless network. There is no credential exchange, token validation, or session handling before commands are accepted. Authorization checks on HTTP API routes are also absent, so no role separation exists between viewer and operator.

Attack Vector

An attacker associates with the Vision 60 internal Wi-Fi network and issues HTTP requests to the administration interface or API. No password, key, or client certificate is required. Requests to start, stop, or steer the robot execute as if issued by a legitimate operator, and camera and sensor streams are returned on request.

The vulnerability manifests in the network exposure and request-handling logic of the Vision 60 control services. See the INCIBE Security Advisory for vendor-coordinated technical details.

Detection Methods for CVE-2026-12989

Indicators of Compromise

Unexpected client associations on the Vision 60 internal Wi-Fi network from unrecognized MAC addresses.
HTTP API requests to control endpoints (Play, Pause, Stop, E-Stop) originating from clients that are not the paired operator device.
Camera or sensor data streams (GPS, RTK, SAM, LIDAR) being retrieved during periods of expected inactivity.

Detection Strategies

Monitor Wi-Fi association logs on the robot for unknown client identifiers and repeated connection attempts.
Capture and inspect HTTP traffic on the internal network for unauthenticated calls to administrative or control API routes.
Correlate physical robot behavior (unexpected movement, e-stop triggers) with API access logs to identify unauthorized command issuance.

Monitoring Recommendations

Deploy wireless intrusion detection near operational deployments to flag rogue clients within Vision 60 Wi-Fi range.
Forward robot HTTP access logs and system events to a centralized SIEM for retention and analysis.
Alert on any HTTP API invocation that lacks a valid session or originates outside the approved operator device inventory.

How to Mitigate CVE-2026-12989

Immediate Actions Required

Restrict physical and RF access to the Vision 60 during operation to shrink the adjacent-network attack surface.
Disable the internal Wi-Fi network when not required, or reduce its transmit power to the minimum operational range.
Segment the robot's control network from any bridged or uplinked infrastructure to prevent pivoting from other networks.
Contact Ghost Robotics for an updated firmware and mobile application build that enforces authentication on the web interface and HTTP API.

Patch Information

No vendor patch identifier is listed in the NVD entry at publication. Operators should consult the INCIBE Security Advisory and coordinate directly with Ghost Robotics for a fixed release of the Vision 60 mobile application and control services.

Workarounds

Enable WPA2/WPA3 with a strong, unique pre-shared key on the Vision 60 internal Wi-Fi to limit who can associate with it.
Change the default SSID and pre-shared key on every deployed unit and rotate them on a defined schedule.
Enforce MAC address allowlisting so only the approved operator handset can associate with the robot's Wi-Fi.
Operate the robot only in controlled areas where hostile devices cannot enter Wi-Fi range.

bash

# Configuration example: recommended hardening steps for the operator handset network
# 1. Rotate the Wi-Fi PSK on the robot control interface
# 2. Enforce MAC allowlisting for the paired operator device only
# 3. Disable Wi-Fi when the robot is idle or in transport