Multiple vulnerabilities in Ghost Robotics' Vision 60
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot (APK v5.5.0) exposes the system to man-in-the-middle attacks. An attacker located on the local network can use ARP spoofing and selective traffic blocking techniques to intercept and manipulate packets between the legitimate operator and the robot. This allows the attacker to disconnect the original controller, establish unauthorized communications, and prevent the operator from regaining control of the device, seriously compromising the confidentiality, integrity, and availability (CIA) of operations.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ghost Robotics | Vision 60 | 5.5.0 | — | No fix listed | CNA |
- Vision 60 VendorGhost Robotics Affected 5.5.0 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:ghostrobotics:vision_60_firmware:*:*:*:*:*:*:*:* | — | — | Ghost Robotics |
- cpe:2.3:o:ghostrobotics:vision_60_firmware:*:*:*:*:*:*:*:* Versions — — ·Ghost Robotics
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12991
- 2026-10-03 Alias added: GHSA-55c3-q2mc-rv5w
References
More Ghost Robotics vulnerabilities
- TI-2026-11051 Multiple vulnerabilities in Ghost Robotics' Vision 60 CVSS 4.0HIGH 8.7
- TI-2025-27459 Use of Hard-coded Credentials vulnerability in Ghost Robotics' Vision 60 CVSS 4.0HIGH 8.7
- TI-2025-27458 Improper Authentication vulnerability in Ghost Robotics' Vision 60 CVSS 4.0CRITICAL 9.2
- TI-2026-11052 Multiple vulnerabilities in Ghost Robotics' Vision 60 CVSS 4.0HIGH 7.7
- TI-2025-27460 Improper Authentication vulnerability in Ghost Robotics' Vision 60 CVSS 4.0HIGH 7.0
Sources
- CVE-2026-12991 · CVE Program
- CVE-2026-12991 · NVD
- FIRST EPSS
- GHSA-55c3-q2mc-rv5w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences