Unitree

Unitree G1 EDU firmware versions 1.5.2 and earlier contain a chained vulnerability in the BLE GATT server and WiFi provisioning stack, allowing unauthenticated proximate attackers to achieve root-level remote code execution.

Unitree G1 EDU firmware through 1.5.2 is susceptible to unauthenticated remote code execution allowing root-level command injection via a chained exploit targeting the WebRTC-to-DDS bridge, hardcoded credentials, and path traversal in the knowledge upload API.

Commercially available Unitree robots are susceptible to multiple vulnerabilities, including hardcoded keys and command injection, allowing attackers to gain root-level access, exfiltrate data, and potentially create physical botnets.