CVE-2026-76640

Received Received - Intake

Unauthenticated Root Code Execution in Unitree G1 EDU Firmware

Publication date: 2026-08-27

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi provisioning script and a buffer overflow in the SSID chunk accumulator. Attackers can send crafted BLE writes to overflow a fixed BSS buffer across BLE connections, corrupting an adjacent mainloop function pointer dispatch entry that is subsequently invoked by the cleanup path passing attacker-controlled data to system() as uid 0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-28

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-76640

Affected Vendors & Products

Vendor	Product	Version / Range
unitree	unitree_g1_edu_firmware	to 1.5.2 (inc)
unitree	edu_firmware	1.5.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-76640 is a critical unauthenticated remote code execution (RCE) vulnerability in Unitree G1 EDU firmware through version 1.5.2. It involves multiple chained flaws in the BLE GATT server and WiFi provisioning stack. Attackers within Bluetooth range can exploit a buffer overflow in the SSID chunk accumulator and an unquoted heredoc variable in the WiFi provisioning script to gain root access without credentials or pairing. The attack corrupts a function pointer in the mainloop, passing attacker-controlled data to system() as root.

Detection Guidance

Detecting this vulnerability requires checking for Unitree G1 EDU firmware versions up to 1.5.2 and monitoring for unauthorized BLE activity or WiFi provisioning anomalies. Use BLE scanning tools like hcitool or bluetoothctl to check for unexpected connections to the robot's BLE interface (characteristic 0xFFE2). Inspect WiFi configuration scripts for signs of heredoc injection or buffer overflow attempts in the wifi_ssid parameter. Monitor system logs for crashes in the btgatt-server process or unexpected root shell executions.

Impact Analysis

This vulnerability allows attackers within Bluetooth proximity to gain full root control over the Unitree G1 robot. They can execute arbitrary commands, modify WiFi configurations, and potentially take over critical functions like motors, cameras, and voice. The exploit chain is wormable, meaning a compromised robot could spread the attack to other nearby units.

Compliance Impact

This vulnerability allows unauthenticated attackers to gain root code execution on the Unitree G1 robot via BLE or WiFi, potentially compromising sensitive data processing and storage. For GDPR, this could lead to unauthorized access to personal data handled by the robot, violating principles of data protection and user consent. Under HIPAA, if the robot processes health-related data, the breach could expose protected health information, leading to compliance failures and legal penalties.

Mitigation Strategies

Immediately update the Unitree G1 EDU firmware to the latest version beyond 1.5.2. Disable unnecessary BLE services or restrict BLE access to trusted devices only. Implement network segmentation to isolate the robot from critical systems. Monitor cloud API interactions for unauthorized AES key decryption requests. Disable WiFi provisioning scripts temporarily if not in use and audit WiFi configuration processes for command injection vulnerabilities.

Hi! I’m here to help you understand CVE-2026-76640. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70