CVE-2026-12989: high-severity vulnerability in Ghost Robotics Vision 60
Multiple vulnerabilities in Ghost Robotics' Vision 60
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.3%
A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization mechanisms, the attacker can view real-time camera feeds, control the robot’s movements, manage sensors (GPS, RTK, SAM, LIDAR), and execute critical operational commands (Play, Pause, Stop, E-Stop). Successful exploitation completely compromises the confidentiality, integrity, and physical security of the system.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Ghost Robotics · Vision 60Related CVEs — Ghost Robotics Vision 60
In the same product, most dangerous first.
CVE-2025-41109HIGHUse of Hard-coded Credentials vulnerability in Ghost Robotics' Vision 60EPSS 0.6%CVE-2025-41108CRITICALImproper Authentication vulnerability in Ghost Robotics' Vision 60EPSS 0.3%CVE-2025-41110HIGHImproper Authentication vulnerability in Ghost Robotics' Vision 60EPSS 0.3%CVE-2026-12991HIGHMultiple vulnerabilities in Ghost Robotics' Vision 60EPSS 0.2%CVE-2026-12990HIGHMultiple vulnerabilities in Ghost Robotics' Vision 60EPSS 0.2%