CVE-2025-10772: huggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authentication

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-22 · updated 2026-06-17
Weakness: CWE-287

Description

A vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robot_devices/robots/lekiwi_remote.py of the component ZeroMQ Socket Handler. The manipulation leads to missing authentication. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Hugging Face LeRobot: 0.3.0, 0.3.1, 0.3.2, 0.3.3

References

https://vuldb.com/?ctiid.325128
https://vuldb.com/?id.325128
https://vuldb.com/?submit.649798
https://vuldb.com/?submit.649798

Get alerted when CVE-2025-10772 or the next vulnerability affects your stack