# EAI07: CPS, firmware, comms & teleoperation compromise

> Classic cyber-physical weaknesses — hardcoded keys, unauthenticated ROS 2/DDS, command injection, hijacked teleop. Out of scope for a VLA-policy red-teamer.

Out of scope for a VLA-policy red-teamer by design — no Provael attack, no SARIF rule.

## Definition

This is the classic cyber-physical attack surface of the robot and its control links: insecure setup interfaces, hardcoded keys, unauthenticated or unencrypted middleware (ROS 2 / DDS), command injection, and hijacked or spoofed teleoperation. It is the threat practitioners feel today — no exotic ML needed to drive a fleet of robots.

It is out of scope for Provael by design. This is an infrastructure / CVE layer (IEC 62443 · MITRE ATT&CK for ICS); faithful coverage would need real exploit tooling this tool deliberately will not ship. It is listed here for completeness and cross-mapping, not because Provael attacks it.

## Real example

UniPwn (Sept 2025, CVE-2025-60250 / CVE-2025-60251) is a root takeover of Unitree Go2/B2/G1/H1 over BLE via a hardcoded key (the “secret” was the string `unitree`) plus unsanitized input to system(), and it is wormable across robots. The Unitree Go1 backdoor (CVE-2025-2894) shipped a pre-installed remote-access tunnel. Teleop matters because many “autonomous” demos are actually human-operated.

## How Provael tests it

- Provael does not attack this layer. It is a cyber-physical / firmware / network problem (IEC 62443, MITRE ATT&CK for ICS), not a VLA-policy behaviour, and covering it faithfully would require real exploit tooling this tool deliberately will not ship.
- There is no Provael attack family, no channel, and no SARIF rule for EAI07 — it emits no finding.
- Handle it with cyber-physical security practice: authenticated + encrypted control, secure boot, network segmentation, and the mitigations below.

## Mitigations

- No hardcoded secrets; authenticated and encrypted control and DDS (SROS2 on, not disabled for latency).
- Secure boot and signed firmware; network segmentation; authenticated, integrity-checked teleoperation.
- Treat the robot as hostile-internet-exposed CPS.

## Crosswalk

- OWASP: ASI07 Insecure Inter-Agent Comms (partial — CPS/firmware has no clean ASI peer)
- MITRE ATLAS: MITRE ATT&CK for ICS (not ATLAS — this is the CPS / ICS layer)
- Frameworks: ISO 10218:2025 — cyber clause, IEC 62443, CWE-321 (hardcoded key), CWE-78 (command injection)

Canonical: https://www.provael.com/eai-top-10/eai07 · v0.2

---
Provael · Prove it. Prevail. · Apache-2.0 · https://github.com/provael/provael
Not legal advice; verify regulatory dates against the primary source.