CVE-2026-12991 is a man-in-the-middle vulnerability in Ghost Robotics' Vision 60 quadruped robot. The command protocol between operator and robot carries no encryption, no integrity verification, and critically, no mutual authentication. An attacker on the local network can perform ARP spoofing to intercept the existing controller's connection, sever that legitimate link, and lock the operator out while maintaining full control of the robot. This isn't eavesdropping—it's hijacking with persistence.
The CVSS 8.7 score doesn't tell the full story. For a robot marketed to defense and critical infrastructure customers, the 'local network access required' prerequisite is not a meaningful barrier. Military deployments explicitly model network compromise as a baseline threat. An adversary who already has local network presence—a realistic scenario for contested or compromised perimeters—can seize control of a mobile physical platform that can traverse bases, facilities, and operational zones.
Once compromised, the robot becomes a capability for the attacker: a mobile sensor platform, a relay for deeper network intrusion, or a kinetic asset. CVSS scores the entry point but cannot capture what happens after an attacker gains control of a physical agent.
Immediate actions: treat any Vision 60 deployment as currently compromised and segment it from sensitive networks. Deploy ARP spoofing detection on any segment handling robot traffic. Contact Ghost Robotics for firmware updates—mutual TLS or packet signing must be the minimum bar for any remediation. If you're procuring these systems, require cryptographic authentication in the specification.
The deeper lesson is structural: embedded robotics continues the pattern seen in SCADA, medical devices, and connected vehicles—treating local networks as trusted boundaries despite three decades of evidence that sophisticated adversaries treat that assumption as irrelevant. The vulnerability isn't sophisticated; it's the absence of foundational controls that should be non-negotiable for any networked cyber-physical system.