Unitree — Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth (CVE-2026-76639 & CVE-2026-76640)

Publication date: August 28, 2026
Category: Vulnerability / IoT Security / Robotics

Introduction

Security in advanced robotics and autonomous systems has taken center stage following the disclosure of two independent remote code execution (RCE) chains granting root privileges on the Unitree G1 EDU humanoid robot. Discovered by security researcher Olivier Laflamme, the vulnerabilities allow attackers to compromise the robot’s Locomotion PC through vectors ranging from adjacent network access to Bluetooth Low Energy (BLE) proximity. Given the expanding deployment of these humanoid systems in research and testing facilities, the initial absence of a definitive firmware patch elevates the risk of complete hardware takeover.

What is CVE-2026-76639 and CVE-2026-76640? (General Analysis)

The vulnerabilities identified in Unitree G1 EDU firmware up through version 1.5.2 highlight severe architectural flaws in the robot’s control and provisioning framework.

  • CVE-2026-76639 (Official NVD Score: 8.7 High | Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) combines an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API, enabling arbitrary command execution as root.
  • CVE-2026-76640 (Official NVD Score: 7.7 High | Vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) exploits the BLE GATT server and Wi-Fi provisioning stack through unauthenticated proximate interactions, leveraging an unquoted heredoc variable and a buffer overflow in the SSID chunk accumulator.

These flaws directly expose the robot’s core operating environment, enabling malicious actors to operate hardware, disrupt critical services, or pivot into local networks.

CVECategory (CWE)ImpactCVSSVector (summary)
CVE-2026-76639CWE-22 (Path Traversal), CWE-306 (Missing Authentication)Root Code Execution8.7 (High)Adjacent Network, Unauthenticated
CVE-2026-76640CWE-306 (Missing Authentication), CWE-787 (Out-of-bounds Write)Root Code Execution7.7 (High)BLE Proximity, High Complexity

How Does It Work? (Technical Analysis)

Laflamme’s research outlines two distinct exploit chains targeting design oversights in the G1 EDU firmware:

  • Attack Flow for CVE-2026-76639: An adjacent network attacker interacts with TCP port 9991, hosting an unauthenticated WebRTC-to-DDS bridge. Leveraging world-readable permissions on a static AES-128 key, the attacker publishes DDS control messages to restart the bashrunner service. Using a path traversal flaw within the chat_go API, a malicious payload is planted inside the script execution directory, triggering execution under uid 0 (root) via the bashrunner subprocess.
  • Attack Flow for CVE-2026-76640: This chain originates from unpairing BLE bootstrap interactions. Cloud authorization gaps allowed arbitrary accounts to recover key material belonging to other G1 units without verifying ownership. Once the key is obtained, the required authenticated BLE state for Wi-Fi provisioning is established. Sending crafted BLE writes overflows a fixed BSS buffer across connections, corrupting an adjacent mainloop function pointer dispatch entry. This pointer is subsequently invoked during cleanup, passing attacker-controlled data directly to system() as root.

“The combination of inadequately isolated network communication bridges and logical flaws in wireless provisioning workflows demonstrates how modern robotic devices inherit traditional IoT vulnerabilities, putting physical hardware integrity at risk.”

Affected Systems / Environments

  • Affected Hardware: Unitree G1 EDU units (broader applicability across other Unitree robot models remains unconfirmed).
  • Firmware Versions: Firmware versions through 1.5.2.
  • Impacted Organization Profiles: Academic research institutions, robotics laboratories, and system integrators operating humanoids on local networks or within uncontrolled Bluetooth proximity.

Mitigation and Detection

Remediation

  • Firmware Upgrades: Apply manufacturer-supplied firmware patches and updates as soon as they become officially available to remediate both vulnerability chains.
  • Network Segmentation: Isolate G1 EDU robots into strictly controlled VLANs, restricting unnecessary traffic to internal control ports (such as TCP port 9991).
  • Radio Frequency Hardening: Disable or limit BLE and Wi-Fi interface visibility when provisioning is not actively required, or restrict physical access to the operating environment.

Detection

  • DDS/WebRTC Traffic Monitoring: Audit network traffic for anomalous frames directed toward TCP port 9991 or unexpected calls to movement control services.
  • System Log Analysis: Review kernel logs and bashrunner activity for path traversal attempts, unusual file creation, or script execution in unauthorized directories.

Wrapping Up

The disclosure of CVE-2026-76639 and CVE-2026-76640 in the Unitree G1 EDU underscores the critical need for robust security design and strict authentication standards in advanced robotics. The ease with which privilege escalation can be achieved through exposed network services and Bluetooth connections demonstrates that cybersecurity in robotics is fundamentally tied to operational physical safety.

References