CVE-2026-12991: high-severity vulnerability in Ghost Robotics Vision 60
Multiple vulnerabilities in Ghost Robotics' Vision 60
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.2%
The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot (APK v5.5.0) exposes the system to man-in-the-middle attacks. An attacker located on the local network can use ARP spoofing and selective traffic blocking techniques to intercept and manipulate packets between the legitimate operator and the robot. This allows the attacker to disconnect the original controller, establish unauthorized communications, and prevent the operator from regaining control of the device, seriously compromising the confidentiality, integrity, and availability (CIA) of operations.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Ghost Robotics · Vision 60Related CVEs — Ghost Robotics Vision 60
In the same product, most dangerous first.
CVE-2025-41109HIGHUse of Hard-coded Credentials vulnerability in Ghost Robotics' Vision 60EPSS 0.6%CVE-2026-12989HIGHMultiple vulnerabilities in Ghost Robotics' Vision 60EPSS 0.3%CVE-2025-41108CRITICALImproper Authentication vulnerability in Ghost Robotics' Vision 60EPSS 0.3%CVE-2025-41110HIGHImproper Authentication vulnerability in Ghost Robotics' Vision 60EPSS 0.3%CVE-2026-12990HIGHMultiple vulnerabilities in Ghost Robotics' Vision 60EPSS 0.2%