CVE-2025-41108: Improper Authentication in Ghost Robotics Vision 60 robot control protocol
CVE-2025-41108 affects Ghost Robotics Vision 60 version 0.27.2 and is classified as CWE-287, Improper Authentication. NVD scores it 9.8 under CVSS 3.1 (critical), and the record describes a communication protocol without encryption or authentication that could let an attacker send commands to the robot. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.
Overview
CVE-2025-41108 is an improper authentication weakness (CWE-287) in the communication protocol used by the Ghost Robotics Vision 60 robot, as described in the record. The description states that the protocol lacks both encryption and authentication, and that it is based on MAVLink, a widely documented protocol. The record is based on an INCIBE advisory.
Impact
- According to the record, an attacker could impersonate the control station and gain unauthorised full control of the robot.
- The record states that an attacker could capture legitimate traffic between the robot and its controller and reuse it to send valid commands.
- NVD assigns a CVSS 3.1 base score of 9.8 (critical), with an impact vector rated high for confidentiality, integrity and availability.
- INCIBE lists CVSS 4.0 scores of 9.2.
Affected products and versions
- Ghost Robotics Vision 60, version 0.27.2.
- Ghost Robotics Vision 60 Firmware, version 0.27.2.
- The record lists no other affected versions and no fixed versions. This does not mean no fix exists; the status is unknown from the available data.
Exploitation status
The CISA KEV catalogue does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The SSVC data in the record marks exploitation as none and automatable as no, while the EPSS data shows a low predicted exploitation probability.
Remediation and mitigation
- Check with Ghost Robotics or the INCIBE advisory for an updated firmware or software version that addresses this issue.
- Restrict network exposure of the robot control interface, especially for Wi-Fi and 4G/LTE remote access.
- Place remote control links behind private, authenticated network channels and segment control networks from untrusted networks.
- Limit which devices can reach the robot control interface and review who holds control station credentials or devices.
Detection guidance
- Monitor for control sessions or commands originating from unknown devices or unexpected network addresses.
- Log and review connections over Wi-Fi and 4G/LTE links to the robot.
- Alert on unexpected changes in robot behaviour or control state.
Limitations of the available information
The record does not state a fixed version, a vendor patch or a workaround from the vendor. The sources consulted are NVD, the CVE Program record and the INCIBE advisory. Details on the exact protocol implementation, the authentication model in newer releases, and the operational environment are not in the record.
Frequently asked questions
What is CVE-2025-41108?
It is an improper authentication weakness (CWE-287) in the communication protocol of the Ghost Robotics Vision 60 robot, version 0.27.2, as described in the record.
Is this CVE being actively exploited?
The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.
Is there a fixed version?
The record lists no fixed version. The absence of a listed fix does not confirm that none exists, so the status should be checked with the vendor or the INCIBE advisory.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.