CVE-2025-41108 is a critical flaw (CVSS 9.8) in Ghost Robotics Vision 60 v0.27.2. Its control protocol has no encryption or authentication, so an attacker could impersonate the control tablet and take full control. INCIBE reported no fix, so isolate the robot network.
What's affected
The CVE record names Ghost Robotics Vision 60 firmware v0.27.2. The record says the communication protocol is based on MAVLink, a widely documented protocol, and that the robot can be reached remotely over Wi-Fi or 4G/LTE.
INCIBE coordinated three vulnerabilities for this robot. This one is the critical item. CVE-2025-41109 concerns hard-coded credentials and CVE-2025-41110 is a second authentication weakness with a physical access vector. The notice also credits the researchers who reported these issues.
On remediation, INCIBE said no solution had been reported when it published. I could not confirm a fixed firmware, so contact the manufacturer for current guidance.
How to check if you're exposed
Find out which units you operate and which firmware they run. The record names v0.27.2, so treat that version as affected. For other versions, ask the manufacturer.
Then map how each robot connects. The record says remote control is possible by Wi-Fi and by 4G/LTE. Which network does your control station use? Who else can join that network? Is the cellular link exposed beyond your operator team?
Check whether any traffic between tablet and robot passes across shared or public networks, because the record says legitimate traffic could be captured and replayed.
What to do now
- List every Vision 60 unit and its firmware version.
- Put the control network on its own segment, with no shared guest or office Wi-Fi.
- Use a VPN or private link for any remote operation, and disable remote links you do not use.
- Ask Ghost Robotics for patch status and for hardening guidance in writing.
- Add physical and operational controls: keep control tablets locked and treat the robot as unsafe to use near people if control may be compromised.
Why it matters
The weakness is CWE-287, improper authentication. The control link accepts commands without proving who sent them, and nothing encrypts the traffic. That means a captured legitimate command can be sent again from any device. The record is plain that an attacker needs only to capture and replay valid traffic.
This CVE is not on the CISA Known Exploited Vulnerabilities list. The consequence here is physical, not just a data leak, which is why the score is high. Robots and other connected machines should be treated like any other remotely reachable system, with network limits and a clear owner.
Quick check
Is there a firmware fix for CVE-2025-41108?
INCIBE reported that no solution had been reported at publication. Ask Ghost Robotics for current status.
What is the best stopgap?
Isolate the control network, avoid shared Wi-Fi, and use a private link or VPN for any remote operation. These steps cut off the replay path the record describes.
Sources
Last reviewed: 18 October 2026.
