Ethical Hacking News
A recent security breach has exposed a critical vulnerability in the Unitree G1 humanoid robot, which could be chained across multiple platforms to gain unauthenticated root access to any G1 within Bluetooth range. This vulnerability has significant implications for organizations that deploy these robots in various settings, including research labs, universities, and workplaces. The Unitree G1 robot, which costs $20,000, is a 90-pound robot that could be used to spy on people, tamper with perception and movement logic, or disable collision detection and other safety checks. Laflamme's research highlights the need for organizations to check the patch status of their G1 robots and take immediate action to secure them against this vulnerability.
Two vulnerabilities (CVE-2026-76639 and CVE-2026-76640) were discovered in the Unitree G1 humanoid robot by researcher Olivier Laflamme. The first vulnerability is a file upload vulnerability that allows an attacker to write arbitrary files on the robot's filesystem, leading to root-level shell execution. The second vulnerability is a Bluetooth characteristic vulnerability that allows an attacker to request the robot's encrypted key bootstrap blob, which can be decrypted by Unitree's cloud API without authentication. The vulnerabilities can be chained together to gain unauthenticated root access to any G1 robot within Bluetooth range. The wormability of the vulnerabilities means that an attacker can spread the attack to other G1 robots within Bluetooth range, potentially leading to a large-scale compromise. Unitree has patched the cloud ownership-check flaw and paid out a combined $5,000 bounty across both chains, with a collaborative response from the company.
In a recent security breach, a researcher named Olivier Laflamme discovered two vulnerabilities in the Unitree G1 humanoid robot, which could be chained across Bluetooth, Unitree's cloud infrastructure, the mobile app, and the robot's firmware to gain unauthenticated root access to any G1 within Bluetooth range. This revelation has significant implications for organizations that deploy these robots in various settings, including research labs, universities, and workplaces.
Laflamme's research, published recently, details the two vulnerabilities, CVE-2026-76639 and CVE-2026-76640. The first bug lives entirely inside the robot itself, no wireless attack surface needed if you can reach it over Ethernet. The G1's AI chatbot service accepts a "knowledge" upload with almost no validation on the filename it writes to disk, and a classic path traversal payload lets an attacker write an arbitrary file anywhere on the filesystem, including into a directory that a separate service called bashrunner treats as trusted. Restart bashrunner, tell it to run the newly planted file, and you’ve got root-level shell execution with five DDS messages and zero authentication.
The second chain is the one that should worry anyone deploying these robots at scale. It starts with a Bluetooth characteristic that accepts writes without pairing, something that The Hacker News also covered in its own report on the disclosure. An unpaired device can request the robot’s encrypted key bootstrap blob, and Unitree’s cloud API would decrypt that blob for any free, logged-in Unitree account without ever checking whether the account actually owned that specific robot.
“The blob is RSA-encrypted & the corresponding RSA private key is held by Unitree’s cloud infrastructure. This, in theory, is safe.. This is the security boundary Unitree appears to have relied on. Nearby devices can request the bootstrap blob, but only Unitree owns the RSA private key capable of opening it,” reads Laflamme’s report. “However, the Unitree mobile app reassembles the BLE notification chunks and slingshots that shit via a POST to Unitree’s cloud API/device/bindExtData on global-robot-api.unitree.com and the app stores the response body as gcmKey.” That decryption oracle is the crux of the whole chain, and Laflamme doesn’t undersell how convenient it made everything.
“This single AES-128 key unlocks both the BLE protocol and the WebRTC signaling channels,” continues the report. Once an attacker has obtained it, they can authenticate to the robot’s Bluetooth handshake and unlock WiFi configuration commands that were previously locked behind that same key. From there, an oversized WiFi password triggers a fallback code path in Unitree’s own configuration script that inserts attacker-controlled text directly into a config file without escaping it, letting the attacker force the robot to join a hotspot they control, no physical access needed at any point.
Going from “the robot connects to my Wi-Fi” to a full root shell required a buffer overflow in the G1’s Bluetooth server, and this is where the research gets particularly impressive. The server used a 500-byte buffer without proper bounds checking, allowing Laflamme to overwrite nearby memory with a carefully crafted 1,050-byte payload. He used that payload to create a fake cleanup structure that the program later interpreted as a legitimate function pointer, causing it to execute an attacker-controlled command with root privileges.
There was one more obstacle: randomized memory addresses. To make the exploit work reliably, Laflamme first needed to discover where the vulnerable program was loaded in memory. He solved that by turning the first vulnerability into an information leak and using the result to make the second exploit work. In other words, one bug effectively helped unlock the other.
The wormability is what turns this from an interesting security flaw into a much more serious operational risk. Once an attacker compromises one G1, that robot can use the same attack against other G1 robots within Bluetooth range, without requiring additional discovery or configuration.
Laflamme tested the technique on just two robots in the same room, so the real-world reach of a chain reaction remains unclear. In a warehouse, laboratory, or campus where dozens of these robots operate close to each other, however, the possibility of one compromised machine spreading the attack to others is difficult to ignore.
Unitree’s response gets genuine credit in the writeup, and it’s worth noting given how often vendor disclosure stories go badly. The company patched the cloud ownership-check flaw within about two months of the report, paid out a combined $5,000 bounty across both chains, and worked through verification quickly enough that Laflamme calls the collaboration close to ideal.
Related Information:
https://www.ethicalhackingnews.com/articles/Unitree-G1-Security-Flaws-A-Wake-Up-Call-for-Organizations-with-IoT-Devices-ehn.shtml
https://securityaffairs.com/198085/hacking/hack-one-robot-reach-the-next-unitree-g1-security-flaws.html
https://ground.news/article/chinese-hackers-target-ai-and-infrastructure-after-breaching-control-networks-cybersecurity-on-all-out-alert
https://thehackernews.com/search/label/APT+group
https://thehackernews.com/search/label/APT+hacking+group
Published: Sat Aug 29 22:31:05 2026 by llama3.2 3B Q4_K_M
