Researcher reveals two vectors that allow remote root in Unitree G1 EDU

A security investigator has revealed two independent chains that allow remote code execution with root privileges on the Unitree G1 EDU robot. According to the technical disclosure published on August 27, 2026 by Olivier Laflamme, the engagement routes are different: an explosion of a cross-border path condition in network components to reach a local executor calledbashrunner, and the other part of a Bluetooth Low Energy (BLE) interaction that, combined with a poor authorization in cloud service, allows to reach a vulnerability of Wi-Fi provision that derives in root execution on the robot locomotion computer.

Facts confirmed: Laflamme has assigned CVE numbers to both failures (CVE-2026-76639 and CVE-2026-76640) and technically documented how each chain culminates in root on the so-called Locomotion PC - the integrated system that controls EDU G1 engines and actuators -. On the network route (CVE-2026-76639) the operation begins with a cross-section path in a service identified aschat _ gothat allows to write in the logic ofbashrunnerwhose abuse leads to execution with root privileges. On the BLE route (CVE-2026-76640) the attacker can write a Bluetooth unmatched start vector; that initial phase alone does not give control, but, according to Laflamme, a defective property check in the cloud service allowed to recover key material for a different robot, which in turn enabled the authenticated state to reach the Wi-Fi supply code, where there is an overflow that allows to rise to root.

What is confirmed and what is not: It is confirmed that Laflamme conducted controlled tests with two G1 in the same room and that it limited the spread of the explosion to that laboratory environment. He also said that Unitree applied in July 2026 an arrangement to the link check between cloud and robot account; according to him, that correction breaks the exact flow he used for his concept test. It is not confirmed by Unitree (at least publicly and according to the information available) which versions of firmware distributed are those that completely correct both CVE, nor whether other Unitree models beyond the G1 EDU share the same vulnerable components.

It is relevant to note another technical precision provided by Laflamme: your test robot was updated to V1.5.2 during work, but that sequence does not in itself establish that version V1.5.1.1 is affected. In other words, there is confirmation of the problem in the laboratory and the operating vector, but the exact map of versions affected in actual installations still lacks a public statement from the manufacturer verifiable by third parties.

How the attacks work, in technical terms: the first chain is based on abuse of file routes (path traversal) on a network interface that allows an attacker to enter commands into a component that it invokesbashrunner; that executor does not carry out sufficient context or privilege controls, and ends up running root permit code in the locomotion subsystem. The second chain combines an initial BLE operation that does not require matching - accepting a protected bootstrap message itself - with a cloud clearance failure that allowed for the recovery of keys associated with another device. With these keys the attacker obtains the authenticated state to run the Wi-Fi supply routine, where there is an exploitable buffer overflow that again culminates with root on the locomotion computer.

Those who are affected and why it matters: operating owners of the Unitree G1 EDU are the group directly at risk - this includes research laboratories, universities, companies that use these robots for education or demonstrations - because an attacker with local network access or with physical proximity Bluetooth could achieve total control of the robot's engines and sensors. The ability to run code as root on the locomotion platform involves physical control (movement of legs, cameras, microphones), loss of data integrity, possibility of installing local persistence and risk of compromising credentials that allow access to other robots or associated services. In addition, key recovery by cloud opens the attack vector from remote accounts if the authorization is not adequately restricted.

Actual implications and practical risks: beyond computer damage, the operation can result in physical damage - collisions, unexpected movements, risk to personnel - and loss of intellectual property or data captured by the robot. If the chain could be replicated to more than two mass units by means of recovered keys or local network propagation, the impact would be greater; for now that spread extent has not been publicly demonstrated.

The implications for organizations that integrate these robots into their operations include the need to revalue physical and logical access controls, to review network segmentation (isolate robots in VLANs), and to adjust supply and authentication processes to prevent a cloud account from compromising key material from other devices.

Specific and urgent measures to be taken by EDU G1 operators: 1) Immediately isolate the G1 EDU robots from unreliable networks and, if possible, temporarily disconnect them from Wi-Fi and cloud until Unitree confirms a parched version. 2) Disable Bluetooth or limit its physical reach; if it cannot, place the robot in a controlled space where there is no nearby public access. 3) Change the credentials of related cloud accounts, activate multifactor authentication and review key recovery records. 4) Ask the manufacturer for the exact firmware version that corrects both CVE and requires proof of image integrity (digital signatures). 5) If you have security capabilities, capture forensic images and robot records before applying updates (to preserve evidence in case of incident). 6) Segment the network: place robots in subnetworks with strict firewall rules, limiting administrative outputs and access. (7) Maintain physical access control procedures that prevent third parties from getting close enough to exploit BE.

For larger-scale managers or corporate security officials, in addition to the above actions it is advisable to notify the internal CSIRT / CERT, coordinate with Unitree to receive formal indications and, if appropriate, involve incident response authorities. Other Unitree models deployed in the organization should also be audited in case they share vulnerable components.

Sources and practical reference: Unitree keeps product and support information on its official site https: / / www.unitree.com /. To understand the particularities and limitations of the BLE matching and its safety, the official Bluetooth specification provides useful technical context https: / / www.bluetooth.com / learn-about-bluetooth / chore-specification /. And for operational guides on the protection of connected devices and good IoT security practices, the US Cybersecurity and Infrastructure Agency. UU publishes practical recommendations that can be adapted to the educational robot environment https: / / www.cisa.gov / stopthinkconnect / sequre-your-devices.

Finally, it is important to stress the uncertainty that still exists: the public list of signed and patched versions has not been verified by third parties, and Unitree has not yet publicly communicated a number of specific firmware that corrects both CVE in all cases. Operators should follow the manufacturer's official communications and apply patches only from verified sources; meanwhile, the containment measures described reduce risk and avoid possible physical damage or subsequent commitments.