Two root remote code execution flaws found in Unitree G1 EDU robot

Based on information from The Hacker News, security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 EDU robot. One of these chains utilizes Bluetooth Low Energy (BLE) to achieve root access on the robot's Locomotion PC.

The vulnerabilities, tracked as CVE-2026-76639 and CVE-2026-76640, present distinct attack vectors. CVE-2026-76639 involves a network-adjacent path through chat_go and bashrunner, leading to root code execution. The second flaw, CVE-2026-76640, begins with BLE proximity, allowing an attacker to initiate a bootstrap interaction without prior pairing. This BLE path can exploit a buffer overflow during Wi-Fi provisioning operations to achieve root execution.

A previously identified authorization gap in Unitree's cloud service, which allowed key material recovery for unauthorized accounts, has reportedly been patched. However, as of the disclosure on August 27, 2026, a confirmed fixed firmware release for the G1 EDU has not been publicly verified, leaving owners without a clear remediation target. The broader applicability of these flaws to other Unitree robot models remains unconfirmed.

Source: The Hacker News