Unitree G1: Unauthenticated Bluetooth RCE Chain of Five Bugs in Humanoid Robot

On August 27, 2026, security researcher Boschko published full details of two vulnerabilities in the Unitree G1 EDU humanoid robot that allow unauthenticated remote code execution with root privileges. The more elaborate attack chain, tracked as CVE-2026-76640, traverses five consecutive bugs starting from Bluetooth Low Energy with no pairing requirement, passes through the vendor's cloud infrastructure, and ends with total control of the robot's locomotion system, cameras, and audio.

The BLE-to-Root Chain: Five Weak Links

The core of CVE-2026-76640 is a multi-hop chain that crosses normally separated trust boundaries. The first link is the G1 EDU's Bluetooth Low Energy interface: GATT characteristic 0xFFE2 exposes write permissions without requiring pairing, as documented in the researcher's blog. From there, bootstrap opcode 0xF2 returns the robot's AES-128 key in the clear, wrapped in an RSA-encrypted response.

The second link is an authorization flaw in the cloud endpoint /device/bindExtData: it decrypted the blob for any authenticated Unitree account without verifying ownership of the associated serial number. As GBHackers reports citing the research, "merely being near the target was enough to recover the unique secret." Unitree subsequently added the account-ownership check.

The third and fourth links operate on local firmware. A 121-byte PSK forces a manual WiFi fallback through the script wpa_connect.sh, where an unquoted heredoc allows configuration injection into the wpa_supplicant daemon. The forced WiFi reconfiguration then opens a path to an information leak from /proc and finally to a buffer overflow in the btgatt-server service, which runs as root: 1,050 bytes written into a 500-byte wifi_ssid buffer.

The fifth link is the actual execution. The exploit corrupts the epoll_terminate event loop's cleanup state, causing system() to execute with root privileges. The shell survives the Bluetooth service crash, leaving persistent access.

CVE-2026-76639: The Second Entry Point

In parallel, CVE-2026-76639 tracks a distinct but convergent attack vector against the same target: RCE as root. According to The Hacker Wire's advisory, the vulnerability carries CVSS 8.8 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and affects G1 EDU firmware up to version 1.5.2.

The mechanism exploits a path traversal in the chat_go module for the knowledge base: it allows arbitrary file writes into the bashrunner service's whitelist directory, which executes as root with extension-agnostic rules. The WebRTC-to-DDS bridge on TCP port 9991 is also unauthenticated and allows publishing of DDS control messages.

The Hacker Wire also notes the presence of a static AES-128 key with world-readable permissions on the device. This element, combined with the Locomotion PC architecture running a real-time Linux kernel with services as root managing motors, cameras, audio, and voice, amplifies the impact surface beyond pure computational compromise.

"Root on a $20,000 humanoid robot from Bluetooth range. One chain crossing Bluetooth, Unitree's cloud, mobile, and the firmware running the G1 itself." — Boschko

Wormability: From Local Vulnerability to Physical Network Risk

Boschko explicitly labeled the exploit "wormable": the code can propagate autonomously from a compromised G1 to the next in Bluetooth range. The statement, reported in his original blog, is precise: "once one G1 is compromised, it can spread the same exploit to the next G1 in range, and so on indefinitely."

This characteristic transforms the risk profile. It is no longer the compromise of a single device in a targeted attack context, but a potential propagation vector in environments with multiple robots: logistics warehouses, commercial showrooms, research labs. The researcher reproduced the bugs on four G1 units and received bounties of $5,000–$6,700 from Unitree, confirming vendor validation of the attack chains.

The dossier does not specify the effective scope of wormability in real-world conditions with environmental interference or Bluetooth distance limits. No evidence of active exploitation in the field has emerged.

Recommended Actions

• Verify the firmware version installed on G1 EDU robots in production: CVE-2026-76639 affects versions up to 1.5.2 per The Hacker Wire advisory.
• Consider disabling the Bluetooth Low Energy interface in environments where mobile provisioning is not required for operation, reducing the attack surface of the CVE-2026-76640 chain.
• Isolate WebRTC-to-DDS bridge traffic on TCP 9991 via network segmentation, as the service is unauthenticated per available technical documentation.
• Contact Unitree to verify the deployment status of complete patches across your robot fleet: sources indicate "most, if not all" vulnerabilities were fixed, but current status may differ.

The Composition Problem in Commercial Robotics

The G1 EDU case is not an isolated bug but a structural demonstration. Every single link in the chain—pairing-less BLE, cloud API with incomplete authorization, unquoted shell scripts, buffer overflow in a root service—is technically containable on its own. The composition of these weak controls across different layers (radio, cloud, firmware, shell scripting) instead produces a multiplied impact that is not readable by analyzing individual components.

The researcher highlighted the remediation complexity in a quote directed at Unitree's security team: "These are genuinely complex bugs to fix," referring to triage and remediation. This element contradicts the narrative that robotics vendors can deploy patches as quickly as consumer software: the intersection of physical security, safety-critical systems, and remote updatability on platforms with real-time kernels introduces stabilization constraints that disclosure programs must anticipate.

The G1's commercial price of approximately $20,000 with availability on retail channels like Amazon lowers the barrier to entry for hardware that until a few years ago was confined to industrial labs. The democratization of humanoid robotics without corresponding maturity in security lifecycles creates a window where publicly documented vulnerabilities can be replicated by actors with moderate resources, without needing zero-day exploits.

Sources

• https://gbhackers.com/unitree-g1-humanoid-robot-flaws/
• https://boschko.ca/g1-ble-rce/
• https://www.thehackerwire.com/unitree-g1-edu-firmware-rce-cve-2026-76639/
• https://gbhackers.com/hackers-can-buy-corporate-executives-social-security-numbers/amp/
• https://security.unitree.com/?ref=boschko.ca
• https://gbhackers.com/critical-bluetooth-protocol-vulnerabilities/
• https://gbhackers.com/mcp-recon-with-cloud-metadata-ssrf/
• https://any.run/threat-intelligence-lookup/?utm_source=csn&utm_medium=100+links&utm_campaign=lookup+tier+1&utm_content=ti+lookup+sales&utm_term=190826#contact-sales

Information verified against cited sources and current as of publication.

Sources