ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

Unitree

1 mentions in 7 days · 4 in 30 days · 4 total · first seen · last

Search everything

Timeline

I spent $4,000 on a robot dog from China

Hands-on review finds the $4,017 Unitree Go2 Pro robot dog affordable but impractical, as Unitree reaches a $34 billion valuation after its IPO.

Ars Technica reviewed the Unitree Go2 Pro quadruped, purchased for $4,017, finding it astonishingly cheap but of limited practical use; it collapsed from battery drain and heat (84°C internal temperature) on an uphill walk at 87°F. Unitree democratized quadruped research, sells humanoid robots from $13,500, and debuted on the Shanghai stock exchange on August 19 with shares rising over fivefold on day one, valuing the company at $34 billion. Its robots now face legal restrictions in the United States, and it competes with Boston Dynamics, whose Spot starts around $75,000.

Ars Technica · AI · 3d agoAI industry

TANGO: Humanoid Navigation in Cluttered Environments with a Whole-Body Vision-Language-Action Model

Researchers introduce TANGO, a whole-body vision-language-action model enabling zero-shot language-guided humanoid navigation on the Unitree G1 robot.

TANGO addresses humanoid navigation in cluttered indoor environments by predicting 29-DoF joint-space actions directly from natural-language instructions and egocentric RGB, rather than 2D path planning. It is trained entirely in simulation via a pipeline combining global path planning, kinematic whole-body motion generation, obstacle-aware motion editing, and RL-based tracking. In simulation it achieves state-of-the-art vision-language navigation performance and transfers zero-shot to a Unitree G1 humanoid without any real-world navigation data.

Hugging Face daily papers · 8d agoAI research1

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Researcher disclosed two root RCE chains in Unitree G1 EDU robots (CVE-2026-76639, CVE-2026-76640), one reachable via unpaired Bluetooth, with no confirmed fixed firmware.

Security researcher Olivier Laflamme disclosed two independent root remote code execution chains in the Unitree G1 EDU robot: CVE-2026-76639, a network-adjacent path through chat_go and bashrunner, and CVE-2026-76640, a Bluetooth Low Energy path that ends with a 1,050-byte buffer overflow in btgatt-server giving root on the Locomotion PC. The BLE chain also exploits a cloud authorization gap that let any valid Unitree account recover another robot's AES key, then forces the robot onto an attacker hotspot via wpa_connect.sh heredoc injection. Unitree patched the cloud ownership check in July 2026, but no confirmed fixed firmware release addresses the BLE issues; the PoC was limited to two robots in one room and no in-the-wild exploitation is reported.

The Hacker News · 13d agoVulnerabilityCVE-2026-76639CVE-2026-76640

Hack One Robot, Reach the Next: Unitree G1 Security Flaws

Researcher chained two Unitree G1 flaws (CVE-2026-76639, CVE-2026-76640) to gain unauthenticated root access, with compromised robots able to infect others via Bluetooth.

Security researcher Olivier Laflamme chained a path-traversal file-write flaw (CVE-2026-76639) in the G1 chatbot service and a Bluetooth server buffer overflow (CVE-2026-76640) to achieve unauthenticated root access remotely. The chain abuses Unitree's cloud API as a decryption oracle for the AES-128 key that unlocks BLE and WebRTC channels, and a compromised robot can propagate the attack to nearby G1 units. Unitree patched the cloud ownership-check flaw, paid a $5,000 bounty, and firmware fixes for BLE pairing and the buffer overflow remain harder to deliver.

Security Affairs · 17d agoVulnerabilityCVE-2026-76639CVE-2026-76640

Related CVEs

  • CVE-2026-766398.7<1%
    Unauthenticated Root RCE Chain in Unitree G1 EDU Robot Firmware
    Unitree G1 EDU firmware through version 1.5.2 contains an unauthenticated remote code execution flaw that chains three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw (CWE-22) in the chat_go knowledge upload API. A network-adjacent attacker can publish DDS control messages over the bridge to restart the bashrunner service, use the path traversal to plant a malicious payload in the bashrunner script execution directory, and then trigger its execution as uid 0. Because commands run as root, an attacker gains full control of the robot's operating system, not just its motion controls. All operators running G1 EDU firmware at or below 1.5.2 are affected, particularly those with port 9991 reachable from shared or wireless networks. Exploitation has not yet been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.7% chance of exploitation in the next 30 days.
    · Unitree G1 EDU robot firmware all versions through and including 1.5.2niche
  • CVE-2026-766407.7<1%
    Unauthenticated Root RCE via BLE in Unitree G1 EDU Firmware ≤ 1.5.2
    Unitree G1 EDU firmware through version 1.5.2 chains two flaws—an unquoted heredoc variable in the WiFi provisioning script and an out-of-bounds write in the SSID chunk accumulator of the BLE GATT/WiFi provisioning stack—that require no pairing, credentials, or user interaction. An unauthenticated attacker within BLE range sends crafted BLE GATT writes that overflow a fixed BSS buffer across BLE connections, corrupting an adjacent mainloop function-pointer dispatch entry. When the cleanup path later invokes the corrupted entry, attacker-controlled data is passed to system() as uid 0, giving the attacker root code execution on the robot (CVSS 4.0: 7.7 High, adjacent attack vector). Only operators of Unitree G1 EDU humanoid robots running firmware 1.5.2 or earlier are affected. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so exploitation status is currently none known.
    · Unitree G1 EDU firmware all versions through and including 1.5.2niche

Appears with

product Unitree G1 2organization George Mason University 1organization Unitree 1product Spot 1product TANGO 1product Unitree G1 EDU 1product Unitree Go2 Pro 1ai model TANGO 1vendor Boston Dynamics 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.