Unitree Go2 chat_go set_volume OS command injection via unsanitized Value parameter

#!/usr/bin/env bash
# check_cve_2026_115995.sh
# Checks Unitree Go2 for CVE-2026-115995 (chat_go set_volume OS command injection)
# Run on the Go2 robot via SSH. Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

VULN_FIXED_VERSION="1.1.11.5"
RESULT="UNKNOWN"

# Function to compare semver-like version strings
version_gte() {
  # Returns 0 if $1 >= $2
  printf '%s\n%s' "$2" "$1" | sort -t. -k1,1n -k2,2n -k3,3n -k4,4n -C 2>/dev/null
}

# Attempt 1: Check firmware version from common Unitree version files
FW_VERSION=""
for vfile in /etc/unitree_version /opt/unitree/version /home/unitree/.config/unitree/version /etc/firmware_version; do
  if [ -f "$vfile" ]; then
    FW_VERSION=$(grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' "$vfile" | head -1)
    if [ -n "$FW_VERSION" ]; then
      echo "[INFO] Firmware version from $vfile: $FW_VERSION"
      break
    fi
  fi
done

# Attempt 2: Check if chat_go / gpt_thread.py exists and is running
CHAT_GO_RUNNING=false
if pgrep -f 'chat_go\|gpt_thread' >/dev/null 2>&1; then
  CHAT_GO_RUNNING=true
  echo "[INFO] chat_go process is RUNNING"
else
  echo "[INFO] chat_go process is NOT running"
fi

# Attempt 3: Look for the vulnerable set_volume pattern in gpt_thread.py
VULN_PATTERN_FOUND=false
for pyfile in $(find /opt /home /usr -name 'gpt_thread.py' 2>/dev/null); do
  echo "[INFO] Found gpt_thread.py at: $pyfile"
  # Look for os.system/subprocess with set_volume that lacks input sanitization
  if grep -qE 'def set_volume' "$pyfile" 2>/dev/null; then
    if grep -A5 'def set_volume' "$pyfile" | grep -qE 'os\.system|os\.popen|subprocess\.(call|run|Popen)' 2>/dev/null; then
      # Check if there's any sanitization (shlex.quote, re.sub, etc.)
      if ! grep -A10 'def set_volume' "$pyfile" | grep -qE 'shlex\.quote|re\.(sub|match)|int\(|float\(' 2>/dev/null; then
        VULN_PATTERN_FOUND=true
        echo "[WARN] Vulnerable set_volume pattern detected in $pyfile"
      else
        echo "[INFO] set_volume appears to have input sanitization in $pyfile"
      fi
    fi
  fi
done

# Determine result
if [ -n "$FW_VERSION" ]; then
  if version_gte "$FW_VERSION" "$VULN_FIXED_VERSION"; then
    RESULT="PATCHED"
    echo "[RESULT] PATCHED — firmware $FW_VERSION >= $VULN_FIXED_VERSION"
  else
    RESULT="VULNERABLE"
    echo "[RESULT] VULNERABLE — firmware $FW_VERSION < $VULN_FIXED_VERSION"
  fi
elif [ "$VULN_PATTERN_FOUND" = true ]; then
  RESULT="VULNERABLE"
  echo "[RESULT] VULNERABLE — vulnerable code pattern found in gpt_thread.py"
elif [ "$CHAT_GO_RUNNING" = false ]; then
  echo "[INFO] chat_go is not running; attack surface is not active"
  RESULT="UNKNOWN"
  echo "[RESULT] UNKNOWN — could not determine firmware version; chat_go not running"
else
  RESULT="UNKNOWN"
  echo "[RESULT] UNKNOWN — could not determine firmware version or inspect source"
fi

case "$RESULT" in
  VULNERABLE) exit 0 ;;
  PATCHED)    exit 1 ;;
  *)          exit 2 ;;
esac