Log in Start free

Vulnerability · Published Oct 22, 2025 · Assigned by INCIBE

CVE-2025-41110Improper Authentication vulnerability in Ghost Robotics' Vision 60

High 7.0

In plain English

A high-severity improper authentication in Vision 60 from Ghost Robotics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High
Exploit odds (30 days)0.3%top 83.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK. This vulnerability allows an attacker to connect to the robot's WiFi and view all its data, as it runs on ROS 2 without default authentication. In addition, the attacker can connect via SSH and gain full control of the robot, which could cause physical damage to the robot itself or its environment.

Affected products (as reported)

VendorProductVersions
Ghost Robotics Vision 60 0.27.2

Weakness: CWE-287 · Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References