CVE-2026-76639

Received Received - Intake

Unauthenticated Remote Code Execution in Unitree G1 EDU Firmware

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, plant a malicious payload in its script execution directory via path traversal, and trigger execution of that payload as uid 0 through the bashrunner shell subprocess.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-76639

Affected Vendors & Products

Vendor	Product	Version / Range
unitree	unitree_g1_edu_firmware	to 1.5.2 (inc)
unitree	unitree_g1_edu_firmware	1.5.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-76639 is an unauthenticated remote code execution (RCE) vulnerability in Unitree G1 EDU firmware through version 1.5.2. It allows attackers on the same network to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API.

Detection Guidance

To detect this vulnerability, scan for open TCP port 9991 on the Unitree G1 EDU device. Check for world-readable files containing static AES-128 keys. Inspect the chat_go knowledge upload API for path traversal attempts in logs or network traffic.

Impact Analysis

An attacker could gain full control over the robot, execute arbitrary commands as root, modify system configurations, or disrupt operations. This could lead to unauthorized access, data theft, or physical harm depending on the robot's functions.

Compliance Impact

This vulnerability allows unauthenticated remote code execution as root on the Unitree G1 EDU firmware, enabling attackers to gain full control over the device. Such unauthorized access could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information.

Mitigation Strategies

Immediately update the Unitree G1 EDU firmware to version 1.5.3 or later. Disable the WebRTC-to-DDS bridge on TCP port 9991 if not required. Restrict file permissions to prevent world-readable access to sensitive files like AES keys.

Hi! I’m here to help you understand CVE-2026-76639. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70