Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Summary: Security researcher Olivier Laflamme disclosed two independent root remote code execution chains affecting the Unitree G1 EDU humanoid robot, tracked as CVE-2026-76639 and CVE-2026-76640, the first a network-adjacent path through chat_go and bashrunner and the second starting from Bluetooth Low Energy proximity without pairing. No exact fixed firmware release has been verified in accessible Unitree guidance, and Laflamme said Unitree patched the cloud account-to-robot ownership check in July 2026 but that the underlying BLE issues - an unpaired write to 0xFFE2 and a buffer overflow in btgatt-server - are separate from that fix.
Why it matters: A 1,050-byte write through a 500-byte wifi_ssid buffer corrupted the event loop into calling system() as root on the Locomotion PC, and the cloud gap that let an account recover another robot's AES key was only closed in July 2026 - with no confirmed firmware target for owners to patch to.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-76639 CVE-2026-76640
Related: ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026