AI analysis
Unitree G1 EDU firmware through version 1.5.2 contains an unauthenticated remote code execution flaw that chains three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw (CWE-22) in the chat_go knowledge upload API. A network-adjacent attacker can publish DDS control messages over the bridge to restart the bashrunner service, use the path traversal to plant a malicious payload in the bashrunner script execution directory, and then trigger its execution as uid 0. Because commands run as root, an attacker gains full control of the robot's operating system, not just its motion controls. All operators running G1 EDU firmware at or below 1.5.2 are affected, particularly those with port 9991 reachable from shared or wireless networks. Exploitation has not yet been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.7% chance of exploitation in the next 30 days.
What to do: Check your G1 EDU firmware version and update to a patched release from Unitree as soon as one is available beyond 1.5.2. Until then, restrict access to TCP port 9991 by isolating the robot on a dedicated lab VLAN or firewalling the port, and inspect the bashrunner script execution directory for unexpected planted files.
Affected
| Unitree G1 EDU robot firmware | all versions through and including 1.5.2 |
Estimated exposure
nichelow tens of thousands of G1-series robots deployed worldwide, with the EDU-firmware subset likely in the thousands-to-tens-of-thousands range (no authoritative… — The G1 EDU is a premium humanoid robot sold mainly to research labs, universities, and robotics teams rather than mass-market consumers, and the attack requires adjacent network access to port 9991, so only that small installed base with…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, plant a malicious payload in its script execution directory via path traversal, and trigger execution of that payload as uid 0 through the bashrunner shell subprocess.