What it is
This is the classic cyber-physical attack surface of the robot and its control links: insecure setup interfaces, hardcoded keys, unauthenticated or unencrypted middleware (ROS 2 / DDS), command injection, and hijacked or spoofed teleoperation. It is the threat practitioners feel today — no exotic ML needed to drive a fleet of robots.
It is out of scope for Provael by design. This is an infrastructure / CVE layer (IEC 62443 · MITRE ATT&CK for ICS); faithful coverage would need real exploit tooling this tool deliberately will not ship. It is listed here for completeness and cross-mapping, not because Provael attacks it.
Seen in the wild
UniPwn (Sept 2025, CVE-2025-60250 / CVE-2025-60251) is a root takeover of Unitree Go2/B2/G1/H1 over BLE via a hardcoded key (the “secret” was the string `unitree`) plus unsanitized input to system(), and it is wormable across robots. The Unitree Go1 backdoor (CVE-2025-2894) shipped a pre-installed remote-access tunnel. Teleop matters because many “autonomous” demos are actually human-operated.
Why this is out of scope
- Provael does not attack this layer. It is a cyber-physical / firmware / network problem (IEC 62443, MITRE ATT&CK for ICS), not a VLA-policy behaviour, and covering it faithfully would require real exploit tooling this tool deliberately will not ship.
- There is no Provael attack family, no channel, and no SARIF rule for EAI07 — it emits no finding.
- Handle it with cyber-physical security practice: authenticated + encrypted control, secure boot, network segmentation, and the mitigations below.
What reduces the risk
- No hardcoded secrets; authenticated and encrypted control and DDS (SROS2 on, not disabled for latency).
- Secure boot and signed firmware; network segmentation; authenticated, integrity-checked teleoperation.
- Treat the robot as hostile-internet-exposed CPS.
Crosswalk
- OWASP
- ASI07 Insecure Inter-Agent Comms (partial — CPS/firmware has no clean ASI peer)
- MITRE ATLAS
- MITRE ATT&CK for ICS (not ATLAS — this is the CPS / ICS layer)
- Frameworks
- ISO 10218:2025 — cyber clauseIEC 62443CWE-321 (hardcoded key)CWE-78 (command injection)
See the full framework crosswalk for dates and detail. Not legal advice.