Data Security for Robot Dogs: Closed Network, Separate Video Path and Independent Verification

Independent researchers have documented concrete issues on some models from the same manufacturer. These are public records:

• Go1, CVE-2025-2894: An undocumented remote access tunnel (CloudSail) that started automatically at boot. According to the researchers, camera feeds could be viewed through it without logging in. Unitree said it shut the service down in March 2025.
• UniPwn, CVE-2025-35027: Root access over Bluetooth during Wi-Fi setup, through a hardcoded key and command injection. The MITRE record states that the Go2, G1, H1 and B2 share a common firmware base. Researchers report that the vendor first said a fix could take 'quarters or years', then in September 2025 said most fixes were complete. We found no published fixed B2 release.
• G1 telemetry, arXiv 2509.14139: The G1 humanoid was measured sending status data (battery, joints, service list) to external servers roughly every 300 seconds. Outbound audio or video was not demonstrated. The paper is a single team's preprint, not peer reviewed, and its own volume figures are inconsistent.

Of these models, only the B2 is named: the UniPwn record lists it among the models sharing a common firmware base. No findings have been published for the A2 or As2. Even so, since they come from the same manufacturer, assuming that similar behaviour could exist on them is a prudent starting point.

The honest answer is: unknown. No independent network traffic audit has been published for these three models. It has not been shown that they send data, nor that they do not. That is why we never present 'data never leaves' as a property of the robot.

The right approach is to know the hardware and deal with each exit path one by one. Key features as stated by the manufacturer:

• Unitree B2: an Intel i5 reserved for motion control, an Intel i7 for user development, and up to 3 optional i7 or Orin NX modules. External interfaces are 4 gigabit Ethernet and 4 USB 3.0 ports. The body carries 2 optical and 2 depth cameras. The product page lists no wireless module.
• Unitree A2: an 8-core platform CPU plus an Intel i7 for the user. Wi-Fi 6, Bluetooth 5.2, 2 gigabit Ethernet, CAN and RS485. The manual lists a microphone and a speaker. 4G is optional.
• Unitree As2: an 8-core CPU, Wi-Fi 6, Bluetooth 5.2 and Ethernet. The manual lists a 1080p front camera and a microphone with roughly 5 m pickup range.

The same method applies to the wheeled B2-W and A2-W. The exact hardware inventory is confirmed per project through a teardown at delivery.

This is the most effective measure. The thermal and visible mission camera connects by Ethernet or USB to a mission computer that your organisation owns. It is not wired to Unitree boards. Video is encrypted on that computer with your keys and travels over your own radio network to an on-premises server.

In this setup the mission feed never enters Unitree software, and we can show this with a wiring diagram and traffic inspection. For camera options, see the thermal camera robot dog guide.

There is one limit: the robot's own sensors are a separate matter. The B2 body cameras, the A2 microphone, and the As2 1080p camera and microphone run under Unitree firmware. They are either physically disabled and recorded in the acceptance report, or explicitly accepted as residual risk. Depth cameras may be needed for walking, so which ones can be disabled is settled per project.

A network firewall cannot see a radio that bypasses it. Every wireless interface is therefore handled at hardware level. The table is compiled from manufacturer pages and manuals.

Two notes: if a cellular modem is present, removing the SIM is not enough because there may be an eSIM. Disabling LoRaWAN also disables the stock remote, so a controller that fits your radio infrastructure is installed instead.

• Closed network: The robot only sees your own radio and local network. There is no route to the internet.
• Firewall outside the robot: Default-deny egress, a DNS sinkhole, full logging and alerts for known telemetry addresses and ports.
• No cloud account: No Unitree account is created. The app is used only where unavoidable, such as calibration or remote pairing, on an offline device in AP mode, with a log kept.
• OTA off, firmware frozen: Hashes of every partition are taken at acceptance and checked regularly.
• Update decision gate: Each new release goes through independent analysis, then isolated testing, then staged rollout to the fleet. Never updating is also a risk, so the decision is made per release.
• Own autonomy software: Runs on ROS 2 on the mission computer. The motion board stays on closed Unitree firmware.

How these rules are monitored centrally across several robots is covered in the robot dog fleet management guide.

Architecture needs measurement, not statements. The protocol we propose:

• Teardown and bill of materials: Every radio chip, modem, eSIM and antenna on the robot and payload is listed. Sub-supplier parts such as the LiDAR and thermal core are recorded by brand and model.
• Firmware analysis: Partition hashes are taken, and update agents and hardcoded addresses are searched for.
• Traffic capture of at least 72 hours: In an RF-shielded room with every interface monitored, covering idle, mission, reboot and low battery. It includes a phase with real internet access, because some behaviour only starts once connectivity is detected.
• Spectrum scan: Cellular bands, 2.4 and 5.8 GHz, 865-870 MHz and UWB.
• Penetration test: Bluetooth, Wi-Fi, DDS and local services.
• Re-test after changes: Repeated after every firmware, payload or configuration change.

Candidate bodies in Turkey include TÜBİTAK BİLGEM (OKTEM and the Cyber Security Institute) and the connected-device testing work run with TSE. We found no published accreditation scope for robot teardown, so scope is confirmed directly with each body. The architecture is built to align with Presidential Circular 2019/12: critical data kept in the country (item 1), the cloud restriction (item 3) and a written no-backdoor undertaking from the supplier (item 12).

Can be shown by measurement:

• That mission camera video does not pass through Unitree software.
• That, in the tested configuration and during the test, no packet was observed going from the robot to an outside address.
• That there is no unexpected emission in the scanned bands.

Cannot be guaranteed:

• That the closed motion board firmware has no undiscovered function.
• That behaviour not seen during testing will never happen. A measurement shows it was not observed, not that it is absent.
• That future firmware versions will behave the same way.
• That there is no hardware implant. A teardown lowers this risk but does not remove it.
• Long-term spare parts and supply continuity.

These residual risks are accepted in writing by your organisation or covered by contract. We list them openly.

We have already delivered most of these integrations in the field. Depending on your project, we take on:

• Robot selection: B2 for heavy payloads and rough terrain, A2 for mid-size work, As2 or the wheeled As2-W for light reconnaissance.
• Mission computer, camera payload and a separate video path.
• Disabling radios and unneeded local services, with an acceptance report.
• Closed network, firewall and the update decision process.
• Preparation for independent lab testing and re-tests after changes.

For payload options see Unitree industrial packages, and for use cases the security patrol robot and tunnel and cave mapping guides. For scope and pricing, contact us through the quote form.