CVE-2026-12990: high-severity vulnerability in Ghost Robotics Vision 60
Multiple vulnerabilities in Ghost Robotics' Vision 60
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7epss 0.2%
An access control vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active, legitimate session. This allows the attacker to bypass control restrictions, intercept sensitive information (such as real-time video), and partially interact with the system unnoticed and without disconnecting the legitimate user, compromising confidentiality and operational security.
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Ghost Robotics · Vision 60Related CVEs — Ghost Robotics Vision 60
In the same product, most dangerous first.
CVE-2025-41109HIGHUse of Hard-coded Credentials vulnerability in Ghost Robotics' Vision 60EPSS 0.6%CVE-2026-12989HIGHMultiple vulnerabilities in Ghost Robotics' Vision 60EPSS 0.3%CVE-2025-41108CRITICALImproper Authentication vulnerability in Ghost Robotics' Vision 60EPSS 0.3%CVE-2025-41110HIGHImproper Authentication vulnerability in Ghost Robotics' Vision 60EPSS 0.3%CVE-2026-12991HIGHMultiple vulnerabilities in Ghost Robotics' Vision 60EPSS 0.2%