Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth
Researcher disclosed two root RCE chains in Unitree G1 EDU robots (CVE-2026-76639, CVE-2026-76640), one reachable via unpaired Bluetooth, with no confirmed fixed firmware.
Security researcher Olivier Laflamme disclosed two independent root remote code execution chains in the Unitree G1 EDU robot: CVE-2026-76639, a network-adjacent path through chat_go and bashrunner, and CVE-2026-76640, a Bluetooth Low Energy path that ends with a 1,050-byte buffer overflow in btgatt-server giving root on the Locomotion PC. The BLE chain also exploits a cloud authorization gap that let any valid Unitree account recover another robot's AES key, then forces the robot onto an attacker hotspot via wpa_connect.sh heredoc injection. Unitree patched the cloud ownership check in July 2026, but no confirmed fixed firmware release addresses the BLE issues; the PoC was limited to two robots in one room and no in-the-wild exploitation is reported.
- CVE-2026-76639: chat_go path traversal reaches bashrunner for root execution on the Locomotion PC.
- CVE-2026-76640: unpaired BLE write to 0xFFE2 starts a chain ending in a btgatt-server overflow.
- Cloud service accepted any valid account to recover another robot's AES key; patched July 2026.
- No verified fixed firmware release; BLE issues are separate from the cloud fix.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-76639 | Unauthenticated Root RCE Chain in Unitree G1 EDU Robot Firmware Unitree G1 EDU firmware through version 1.5.2 contains an unauthenticated remote code execution flaw that chains three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw (CWE-22) in the chat_go knowledge upload API. A network-adjacent attacker can publish DDS control messages over the bridge to restart the bashrunner service, use the path traversal to plant a malicious payload in the bashrunner script execution directory, and then trigger its execution as uid 0. Because commands run as root, an attacker gains full control of the robot's operating system, not just its motion controls. All operators running G1 EDU firmware at or below 1.5.2 are affected, particularly those with port 9991 reachable from shared or wireless networks. Exploitation has not yet been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.7% chance of exploitation in the next 30 days. Do: Check your G1 EDU firmware version and update to a patched release from Unitree as soon as one is available beyond 1.5.2. Until then, restrict access to TCP port 9991 by isolating the robot on a dedicated lab VLAN or firewalling the port, and inspect the bashrunner script execution directory for unexpected planted files. | 8.7 | <1% |
| nichelow tens of thousands of G1-series robots deployed worldwide, with the EDU-firmware subset likely in the thousands-to-tens-of-thousands range (no authoritative… | ||
| CVE-2026-76640 | Unauthenticated Root RCE via BLE in Unitree G1 EDU Firmware ≤ 1.5.2 Unitree G1 EDU firmware through version 1.5.2 chains two flaws—an unquoted heredoc variable in the WiFi provisioning script and an out-of-bounds write in the SSID chunk accumulator of the BLE GATT/WiFi provisioning stack—that require no pairing, credentials, or user interaction. An unauthenticated attacker within BLE range sends crafted BLE GATT writes that overflow a fixed BSS buffer across BLE connections, corrupting an adjacent mainloop function-pointer dispatch entry. When the cleanup path later invokes the corrupted entry, attacker-controlled data is passed to system() as uid 0, giving the attacker root code execution on the robot (CVSS 4.0: 7.7 High, adjacent attack vector). Only operators of Unitree G1 EDU humanoid robots running firmware 1.5.2 or earlier are affected. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so exploitation status is currently none known. Do: Check the firmware version on G1 EDU units and upgrade to the first firmware release after 1.5.2 once Unitree publishes a fix. Until then, reduce BLE exposure by keeping untrusted people and devices out of Bluetooth range of the robots and disabling or supervising BLE-based WiFi provisioning. Monitor Unitree advisories, since no public PoC or known exploitation exists today. | 7.7 | <1% |
| nicheunknown, but plausibly on the order of thousands to low tens of thousands of G1 EDU robots deployed worldwide |
Full article567 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalAug 28, 2026Vulnerability / IoT Security
Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 EDU, including a Bluetooth Low Energy (BLE) path that can reach root on the robot's Locomotion PC.
The flaws are tracked as CVE-2026-76639 and CVE-2026-76640, with the first involving a network-adjacent path through chat_go and bashrunner and the second beginning from BLE proximity.
An exact fixed firmware release has not been verified in any accessible Unitree guidance, leaving G1 EDU owners without a confirmed release target for either vulnerability.
Laflamme said Unitree patched the cloud account-to-robot ownership check in July 2026, closing the cross-owner arbitrary-G1 path. As of the August 27 disclosure, a G1 owner could still use an account bound to their own robot to recover its Advanced Encryption Standard (AES) key. The underlying BLE issues, a write to 0xFFE2 that does not require pairing and the BSS buffer overflow, are separate from the cloud fix.
Laflamme published the research on August 27, 2026, describing the two issues as separate root-RCE paths. The research timeline shows Laflamme upgraded the test robot to V1.5.2, but that sequence does not by itself establish V1.5.1.1 as affected.
In his technical disclosure, Laflamme said CVE-2026-76639 uses a path-traversal condition in chat_go to reach bashrunner. Execution through bashrunner results in root code execution on the Locomotion PC.
Laflamme described CVE-2026-76639 as an independent RCE, although he reused it as one disclosure primitive while demonstrating the separate BLE chain tracked as CVE-2026-76640.
For CVE-2026-76640, the initial BLE write path accepts the bootstrap interaction without Bluetooth pairing. The bootstrap material itself remains protected, and the later Wi-Fi provisioning operations require the application's authenticated BLE state.
During Laflamme's research, Unitree's cloud service accepted a valid Unitree account for the key-recovery request but did not verify that the account owned the supplied robot.
That authorization gap allowed the account to recover key material associated with another G1 EDU. The recovered key could then be used to establish the authenticated BLE state required by the Wi-Fi provisioning operations.
The Wi-Fi heredoc injection in wpa_connect.sh then forced the G1 onto the attacker's hotspot, providing a network pivot. Root execution came from a separate buffer overflow in btgatt-server, where a 1,050-byte write through the 500-byte wifi_ssid BSS buffer corrupted the event loop into calling system() as root on the Locomotion PC.
Laflamme limited his propagation test to two G1 robots in one room. He said in the August 27 disclosure that the cloud authorization fix breaks that exact proof-of-concept flow.
Unitree's official product page distinguishes the G1 and G1 EDU as separate models, while broader applicability of the two new vulnerabilities to other Unitree robots remains unconfirmed.
The Hacker News has reached out to Unitree to confirm the fixed firmware versions, the affected product scope, and the current remediation status, and will update the story with any response.
Corrected on September 2, 2026: An earlier version incorrectly located the buffer overflow in the Wi-Fi provisioning code, embedded a non-BLE demonstration where the Bluetooth Low Energy chain was discussed, and did not fully describe the scope of Unitree's cloud authorization fix; the overflow is in btgatt-server, and the video and patch-status description have been corrected.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html