CVE-2026-12990

This CVE exposes a fundamental authentication architecture flaw in Ghost Robotics' Vision 60 companion application (APK v5.5.0 and prior). The session model treats the client as authoritative rather than the server—an architectural inversion that allows a modified application to maintain a simultaneous, undetected session alongside the legitimate operator. This isn't a typical session hijacking vulnerability; it permits cohabitation without disruption, meaning the legitimate operator sees normal telemetry while real-time video and sensor feeds route to an adversary. The 'partial interaction' capability is the highest-consequence element requiring immediate clarification. If an attacker can issue movement commands, adjust sensor parameters, or—critically—manipulate what the operator sees through telemetry injection, this crosses from espionage into potential physical harm vectors. For a robot performing perimeter security or reconnaissance, an undetected session compromise grants the adversary eyes on patrol routes, facility layouts, and operational patterns. Behavioral data compounds over time: machine learning on patrol patterns reveals guard response times and shift change vulnerabilities. The historical pattern matters here. This flaw class—server-validated session state displaced by client-asserted authority—has appeared in medical infusion pumps, industrial robot controllers, and connected vehicles over the past decade. Each CVE generated a write-up and patch, then collective amnesia. The post-exploitation characteristic is nearly identical across cases: defenders rarely discover the compromise through anomaly detection because the attack requires no anomalous behavior—just quiet cohabitation. Standard fleet monitoring has no alert mechanism for 'attacker is watching video feeds right now.' For defenders: treat this as an active intelligence-exfiltration vector, not just a technical authentication flaw. Audit your fleet management infrastructure for downstream connections that may inherit this compromised authentication layer. The EPSS score is misleading for a targeted military platform—it reflects probability of opportunistic exploitation, not nation-state targeting. If you operate Vision 60 units, assume intelligence has been or will be collected during the exposure window; the patch closes the ongoing vector but does not recover already-exfiltrated data.

Reviewed through automated stages and approved by a human before publication.