CyberSecurityBoardThreat Intel · CVEs · Products
Cyber News

FCC Blocks Foreign-Produced Robots and Power Inverters Over Cyber Risks

July 30, 2026

The Federal Communications Commission (FCC) added foreign-produced mobile robots and networked power inverters to its Covered List on July 28, 2026, preventing new models from receiving equipment authorization for import, marketing, or sale in the US. Previously authorized models and existing devices are unaffected, and federal purchases remain unchanged. The FCC granted a waiver through January 1, 2029, for software and firmware updates that patch vulnerabilities or facilitate compatibility. Manufacturers can apply for Conditional Approval, with the Department of War (DoW) approving robotic devices and DoW or DHS approving power inverters by January 1, 2028.

The action is based on two national security determinations sent to the FCC on July 27, defining “foreign-produced” as any article not qualifying as a “domestic end product” under the Buy American standard. The robot definition covers mechanical mobile devices capable of ground locomotion, obstacle avoidance, or navigation, weighing over 4.4 lbs, with environmental sensors and wired/wireless communications at 200 kbps or faster. The inverter definition covers systems converting DC to AC or vice versa with remote communication, control, or monitoring components.

The robot determination cites three security reports: a 2026 finding of unauthorized access to camera feeds and maps from household robots; UniPwn research documenting four Bluetooth Low Energy CVEs including CVE-2025-35027, enabling root command execution on Go2, B2, G1, and H1 units; and CVE-2025-2894, allowing remote control of Unitree Go1 quadrupeds via CloudSail. The inverter determination references Forescout’s SUN:DOWN research on 46 flaws in Sungrow, SMA, and Growatt products, Idaho National Laboratory on supply-chain risks, ERCOT on grid collapse potential, and a case where a foreign manufacturer remotely disabled inverters after a dispute. This is the third category-wide Covered List action after drones (December 2025) and consumer routers (March 2026).

CVEs: CVE-2025-35027, CVE-2025-2894, CVE-2026-50522

Companies: Unitree, Forescout, Sungrow, SMA, Growatt, Idaho National Laboratory, ERCOT

Products: Go2, B2, G1, H1, Unitree Go1, CloudSail