ProductEvidenceTop 10ComplianceDocsStar on GitHubQuickstart
( 07 ) · EAI07

CPS, firmware, comms & teleoperation compromise

Classic cyber-physical weaknesses — hardcoded keys, unauthenticated ROS 2/DDS, command injection, hijacked teleop. Out of scope for a VLA-policy red-teamer.

out of scope for a VLA-policy red-teamer
Definition

What it is

This is the classic cyber-physical attack surface of the robot and its control links: insecure setup interfaces, hardcoded keys, unauthenticated or unencrypted middleware (ROS 2 / DDS), command injection, and hijacked or spoofed teleoperation. It is the threat practitioners feel today — no exotic ML needed to drive a fleet of robots.

It is out of scope for Provael by design. This is an infrastructure / CVE layer (IEC 62443 · MITRE ATT&CK for ICS); faithful coverage would need real exploit tooling this tool deliberately will not ship. It is listed here for completeness and cross-mapping, not because Provael attacks it.

Real example

Seen in the wild

UniPwn (Sept 2025, CVE-2025-60250 / CVE-2025-60251) is a root takeover of Unitree Go2/B2/G1/H1 over BLE via a hardcoded key (the “secret” was the string `unitree`) plus unsanitized input to system(), and it is wormable across robots. The Unitree Go1 backdoor (CVE-2025-2894) shipped a pre-installed remote-access tunnel. Teleop matters because many “autonomous” demos are actually human-operated.

Scope

Why this is out of scope

  • Provael does not attack this layer. It is a cyber-physical / firmware / network problem (IEC 62443, MITRE ATT&CK for ICS), not a VLA-policy behaviour, and covering it faithfully would require real exploit tooling this tool deliberately will not ship.
  • There is no Provael attack family, no channel, and no SARIF rule for EAI07 — it emits no finding.
  • Handle it with cyber-physical security practice: authenticated + encrypted control, secure boot, network segmentation, and the mitigations below.
Mitigations

What reduces the risk

  • No hardcoded secrets; authenticated and encrypted control and DDS (SROS2 on, not disabled for latency).
  • Secure boot and signed firmware; network segmentation; authenticated, integrity-checked teleoperation.
  • Treat the robot as hostile-internet-exposed CPS.
Compliance mapping

Crosswalk

OWASP
ASI07 Insecure Inter-Agent Comms (partial — CPS/firmware has no clean ASI peer)
MITRE ATLAS
MITRE ATT&CK for ICS (not ATLAS — this is the CPS / ICS layer)
Frameworks
ISO 10218:2025 — cyber clauseIEC 62443CWE-321 (hardcoded key)CWE-78 (command injection)

See the full framework crosswalk for dates and detail. Not legal advice.

DOC. PVL-EAI07 · Embodied AI Security Top 10 · v0.2Updated 2026-06-27 · CC BY-SA 4.0