Unitree G1 EDU Firmware BLE Authentication Bypass and RCE

Unitree G1 EDU firmware through version 1.5.2 is susceptible to a high-severity remote code execution vulnerability (CVE-2026-76640) residing within the Bluetooth Low Energy (BLE) GATT server and the associated WiFi provisioning stack. An unauthenticated attacker in physical proximity to the device can leverage this vulnerability to execute arbitrary commands with root privileges. The attack chain involves sending crafted BLE write requests to trigger a buffer overflow in the SSID chunk accumulator, subsequently corrupting a mainloop function pointer dispatch entry. This corrupted pointer is later invoked during a cleanup sequence, which results in the execution of attacker-supplied data via the system() call as uid 0. This vulnerability is significant as it permits complete device compromise without the need for prior pairing, credentials, or user interaction during the WiFi provisioning process.

Attack Chain

1. Attacker identifies a Unitree G1 EDU device with active BLE advertising enabled.
2. Attacker establishes a connection to the device's BLE GATT server.
3. Attacker sends a series of crafted BLE write requests containing malicious SSID payloads.
4. The SSID chunk accumulator buffer is overflowed due to insufficient size validation.
5. The overflow corruption overwrites an adjacent mainloop function pointer dispatch entry in memory.
6. The firmware triggers a cleanup routine that calls the now-corrupted function pointer.
7. Attacker-controlled data is passed to the system() function, resulting in arbitrary code execution with root privileges (uid 0).

Impact

Successful exploitation grants an attacker full control over the Unitree G1 EDU robot, including the ability to manipulate robot movement, access onboard sensors, and exfiltrate data. Given the device's role in educational and research environments, this could lead to the compromise of local network access via the WiFi provisioning vector or the deployment of persistent malicious firmware.

Recommendation

1. Restrict physical and wireless proximity to authorized personnel for all Unitree G1 EDU units.
2. Monitor for firmware update availability from Unitree and prioritize patching to a version beyond 1.5.2.
3. Implement network-level segmentation to limit the impact of compromised robots attempting to move laterally into sensitive infrastructure.
4. Audit logs for anomalous BLE connection attempts or repeated service crashes that may indicate exploitation attempts.