Unitree Go2 Suspicious Script Creation

Tim Peck@timpeck

•updated Mar 2, 2026•1•0•36

Detects the creation or modification of Python scripts in the /unitree/etc/programming/ directory on Unitree Go2 robots. This activity is a strong indicator of exploitation of CVE-2026-27509 or CVE-2026-27510, where an attacker uploads a malicious script for remote code execution.