Vulnerability · Published Jul 27, 2026 · Assigned by INCIBE
CVE-2026-12989Multiple vulnerabilities in Ghost Robotics' Vision 60
High 8.7
In plain English
A high-severity missing authentication in Vision 60 from Ghost Robotics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization mechanisms, the attacker can view real-time camera feeds, control the robot’s movements, manage sensors (GPS, RTK, SAM, LIDAR), and execute critical operational commands (Play, Pause, Stop, E-Stop). Successful exploitation completely compromises the confidentiality, integrity, and physical security of the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ghost Robotics | Vision 60 | 5.5.0 |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N