Skip to content

Unitree G1 EDU: two independent root-RCE chains (CVE-2026-76639, CVE-2026-76640), one starting over Bluetooth

Summary

Security researcher Olivier Laflamme disclosed two independent unauthenticated root remote-code-execution chains in the Unitree G1 EDU humanoid robot on August 27, 2026: CVE-2026-76639 (NVD 8.7 High — a network-adjacent chain through the WebRTC-to-DDS bridge on TCP 9991, a world-readable static AES-128 key, and a path traversal in the chat_go knowledge-upload API that plants a payload into the bashrunner service directory) and CVE-2026-76640 (NVD 7.7 High — a Bluetooth LE chain that reaches root on the Locomotion PC without pairing or credentials via an unquoted heredoc variable in the Wi-Fi provisioning script and a buffer overflow in the SSID chunk accumulator that corrupts a function-pointer dispatch entry invoked through system() as uid 0). Affected firmware: through 1.5.2; no fixed firmware release has been verified in accessible Unitree guidance as of the August 28-29 reporting. Laflamme published the research, PoC material, and the "UniBLEed" disclosure under boschko.ca; VulnCheck published parallel advisories.

Tags

Why this matters

  • Two independent unauthenticated root paths on a consumer/education-grade humanoid means anyone with network-adjacent reach — or BLE range — can take the robot's Locomotion PC as root, with no credentials and no pairing. For deployed fleets (research labs, education programs, demo/retail floors) that is a remote-persistence and pivot primitive into the surrounding lab/office network.
  • The BLE chain (CVE-2026-76640) is the more durable pattern: proximity-based, no network access required, and it exploits a cloud-authorization gap (a valid Unitree account could recover key material for a robot it did not own) chained into Wi-Fi provisioning code.
  • The cloud ownership-check gap was patched by Unitree in July 2026, but as of the August 27 disclosure the cloud-assisted route still requires either an account bound to the target G1 or key material already in hand; the two new firmware chains do not depend on the cloud service at all.
  • The lack of a confirmed fixed firmware target is the operational gap: defenders cannot currently "just patch" — mitigation is exposure reduction.

Operational characteristics

CVE-2026-76639 — network-adjacent chain (root on Locomotion PC)

  • Component: unauthenticated WebRTC-to-DDS bridge listening on TCP 9991.
  • Chain: (1) an attacker can publish DDS control messages that restart the bashrunner service; (2) a static AES-128 key stored with world-readable permissions plus a path traversal in the chat_go knowledge-upload API let the attacker plant a malicious payload in bashrunner's script-execution directory; (3) bashrunner executes that payload in a shell subprocess as uid 0.
  • NVD: 8.7 High; affected: G1 EDU firmware through 1.5.2.

CVE-2026-76640 — BLE chain (root on Locomotion PC, no pairing)

  • Component: BLE GATT server and Wi-Fi provisioning stack.
  • Chain: crafted BLE writes overflow a fixed BSS buffer that persists across BLE connections; the overflow corrupts an adjacent mainloop function-pointer dispatch entry that the cleanup path invokes with attacker-controlled data passed to system() as uid 0. The initial BLE write path accepts the bootstrap interaction without pairing; bootstrap material is protected, and later Wi-Fi provisioning requires the app's authenticated BLE state — which the attacker obtains via the key-recovery cloud gap (a valid Unitree account accepted for key recovery without verification that it owned the robot) plus a buffer overflow in Wi-Fi provisioning.
  • Researcher note: Laflamme reused CVE-2026-76639 as a disclosure primitive while demonstrating the separate BLE chain, and limited his propagation test to two G1 robots in one room; he said the cloud authorization fix breaks that exact PoC flow.
  • NVD: 7.7 High; affected: G1 EDU firmware through 1.5.2.

Version / disclosure state

  • Laflamme upgraded his test robot to V1.5.2; that sequence does not by itself establish V1.5.1.1 as affected.
  • Unitree's product page distinguishes G1 and G1 EDU as separate models; broader applicability to other Unitree robots is unconfirmed.
  • THN contacted Unitree for fixed-firmware confirmation, affected scope, and remediation status; no confirmed release target for either CVE as of August 28-29, 2026.

Defender heuristics

  • Inventory G1 EDU units on lab/office/demo networks; treat the Locomotion PC as an untrusted, attacker-adjacent host — not just a robot.
  • Close TCP 9991 (DDS bridge) from all segments that are not strictly required; the WebRTC-to-DDS bridge is the network-adjacent entry point for CVE-2026-76639.
  • Minimize BLE exposure: physically separate units from adjacent networks where feasible, rotate the units' associated accounts, and treat any valid Unitree account that can reach a target robot's key-recovery flow as a standing risk until the ownership check is confirmed in the deployed firmware.
  • Hunt for post-exploitation: unexpected cron/service entries, new scripts in bashrunner execution directories, anomalous world-readable key material, outbound connections from the Locomotion PC, and system()-spawned shells from the provisioning stack.
  • Do not assume the July 2026 cloud patch is sufficient — the two disclosed chains operate at the firmware level and are independent of the cloud service.
  • Track Laflamme's disclosure page and Unitree firmware notes for the fixed release; until a fixed build is confirmed, exposure reduction (network isolation, account scoping, physical BLE separation) is the primary control.

Sources