Skip to navigation

Threat reportVulnerabilityTL-2026-2196

UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in Unitree G1 EDU Humanoid Robot (CVE-2026-76639, CVE-2026-76640)

criticalACTIVE

Researcher Olivier Laflamme ("Boschko") disclosed two chained root-RCE vulnerability chains in the Unitree G1 EDU humanoid robot's Locomotion PC. CVE-2026-76640 lets a nearby attacker use an unpaired BLE GATT write to recover the robot's AES-128 key via a cloud authorization bypass, hijack its Wi-Fi provisioning, and trigger a buffer overflow in btgatt-server to execute commands as root without pairing or credentials.

Key facts for UniBLEed humanoid robot Bluetooth RCE

IdentifiersTL-2026-2196, CVE-2026-76639, CVE-2026-76640
Also known asUniBLEed
SeverityCRITICAL
CVSS8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
First disclosed
Exploitation statusPublic proof-of-concept exploit
EPSSCVE-2026-76639: 0.7% (51.1th percentile); CVE-2026-76640: 0.3% (26.0th percentile)
Affected productsUnitree Robotics G1 EDU Humanoid Robot (Locomotion PC); Unitree Robotics Unitree companion Android application
Weaknesses (CWE)CWE-306, CWE-787, CWE-22
ToolsUniBLEed, UniTEABag
MITRE ATT&CK techniquesT1046 Network Service Discovery, T1059 Command and Scripting Interpreter, T1059.004 Command and Scripting Interpreter, T1068 Exploitation for Privilege Escalation, T1071 Application Layer Protocol, T1078.004 Valid Accounts, T1082 System Information Discovery, T1091 Replication Through Removable Media, T1190 Exploit Public-Facing Application, T1203 Exploitation for Client Execution, T1210 Exploitation of Remote Services, T1518 Software Discovery and 6 more in the attack flow
MotivationUNKNOWN
Target sectorsrobotics, research and academia, manufacturing, technology
Target regionsGlobal
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for UniBLEed humanoid robot Bluetooth RCE

As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2196 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: UniBLEed: Unpaired BLE GATT Write to Characteristic 0xFFE2 (Unitree G1 Key-Recovery Trigger)

Detects an unpaired/unauthenticated GATT write to characteristic 0xFFE2 (service 0xFFE0) with opcode 0xF2 against a Unitree G1-class BLE peripheral, as forwarded by a BLE monitoring gateway/sniffer. This is the initial-access primitive of CVE-2026-76640 (UniBLEed): it causes the robot to return an RSA-OAEP-wrapped AES-128 bootstrap key to any nearby device without pairing or credentials.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1091
  • Data sources: ble_gateway_ids, bluetooth_sniffer
  • Severity: critical
  • Confidence: high

Splunk SPL

index=ble_iot sourcetype="ble:gatt:write" gatt_service="0xFFE0" gatt_characteristic="0xFFE2" opcode="0xF2"
| eval paired=coalesce(paired,"unknown")
| where paired!="true"
| stats count min(_time) as first_seen max(_time) as last_seen values(peer_mac) as attacker_mac values(target_ble_id) as target_device by src_ip
| where count>=1
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen attacker_mac target_device src_ip count

Microsoft KQL

BleGattEvents_CL
| where TimeGenerated > ago(24h)
| where GattService_s == "0xFFE0" and GattCharacteristic_s == "0xFFE2" and Opcode_s == "0xF2"
| where PairedState_s != "true"
| summarize WriteCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by PeerMac_s, TargetDeviceId_s
| project FirstSeen, LastSeen, PeerMac_s, TargetDeviceId_s, WriteCount

Sigma

title: Unpaired BLE GATT Write to Unitree G1 Characteristic 0xFFE2 (UniBLEed Key Recovery)
id: 7c1a2e10-4f6b-4a9d-9b21-1f2a3c4d5e01
status: experimental
description: Detects an unauthenticated/unpaired GATT write with opcode 0xF2 to characteristic 0xFFE2 (service 0xFFE0) on a Unitree G1-class BLE peripheral, the AES-key-recovery trigger for CVE-2026-76640.
references:
  - https://boschko.ca/g1-ble-rce/
  - https://www.vulncheck.com/advisories/unitree-g1-edu-ble-gatt-rce-via-wifi-provisioning-stack
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
  - attack.initial-access
  - attack.t1091
  - cve.2026.76640
  - attack.tool.unibleed
logsource:
  category: application
  product: ble_gateway
  service: gatt_server
detection:
  selection:
    GattService: '0xFFE0'
    GattCharacteristic: '0xFFE2'
    Opcode: '0xF2'
  filter_paired:
    PairedState: 'true'
  condition: selection and not filter_paired
falsepositives:
  - Legitimate first-time provisioning of a new G1 unit by an authorized technician using the vendor app
level: high

Known false positives:

  • Authorized initial provisioning/pairing of a new G1 unit performed via the official Unitree companion app in a controlled maintenance window

Tuning notes: If a fleet-management BLE gateway is deployed, allowlist its MAC/service-tag so its own provisioning writes are excluded; otherwise correlate with a change-management ticket window before alerting.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • UniBLEed: Cross-Account Abuse of Unitree Cloud AES Key Oracle (/device/bindExtData) · unlock with TL Creds
  • UniBLEed: wpa_connect.sh Heredoc Injection via Oversized Wi-Fi Credential (Rogue AP Hijack) · unlock with TL Creds
  • UniBLEed Wormable Propagation: Single Source Writing GATT 0xFFE2 to Multiple G1 Units in Short Window · unlock with TL Creds
  • Unauthenticated Connection to WebRTC-to-DDS Bridge on TCP/9991 (Unitree G1) · unlock with TL Creds
  • chat_go Knowledge-Upload Path Traversal Into bashrunner Whitelisted Directory (CVE-2026-76639) · unlock with TL Creds
  • Persistent Outbound DDS/RTPS Multicast Traffic From Locomotion PC to Non-Fleet Host (Post-Compromise C2) · unlock with TL Creds
  • UniBLEed: btgatt-server wifi_ssid Oversized GATT Payload (Buffer Overflow Trigger, CWE-787) · unlock with TL Creds
  • btgatt-server Crash Followed by Backgrounded Root Shell (Event-Loop Corruption → system() as Root) · unlock with TL Creds

Indicators of compromise for UniBLEed humanoid robot Bluetooth RCE

As of 2026-08-29, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2196.

Sample indicators (3 of 19)

  • Domain: firmware-cdn[.]unitree[.]com
  • URL: hxxps://global-robot-api[.]unitree[.]com/device/bindExtData
  • Domain: unitree-firmware[.]oss-cn-hangzhou[.]aliyuncs[.]com

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

19 indicators of compromise · unlock with TL Creds. Compare plans

How UniBLEed humanoid robot Bluetooth RCE works

CVE-2026-76639 reaches the same root outcome over the network via an unauthenticated WebRTC-to-DDS bridge and a path-traversal in the chat_go AI service's knowledge-upload path into bashrunner.

UniBLEed is a five-stage exploit chain against the Unitree G1 EDU humanoid robot's Rockchip RK3588 Locomotion PC (Linux 5.10.176-rt86+), published by researcher Olivier Laflamme (handle Boschko) on 2026-08-27 with a companion PoC toolkit and technical writeup. Two CVEs were assigned to the underlying flaws.

CVE-2026-76640 (BLE path, CVSS v3.1 7.5 HIGH / CVSS v4.0 7.7 HIGH) begins with an unpaired write to BLE GATT characteristic 0xFFE2 (service 0xFFE0, notify channel 0xFFE1) using opcode 0xF2, which triggers the robot to return an RSA-OAEP-SHA256-wrapped AES-128 bootstrap key without any authentication or pairing. The attacker then submits this wrapped blob and the robot's serial number to Unitree's cloud endpoint POST /device/bindExtData on global-robot-api.unitree.com using any free, unrelated Unitree account; the endpoint decrypts and returns the plaintext AES-128 key because it never verifies that the requesting account owns the target robot's serial number. With the recovered key, the attacker completes the BLE handshake and sends Wi-Fi provisioning data: a 121-byte PSK/credential value forces /unitree/module/network_manager/wpa_connect.sh into a fallback path where unescaped data inside an unquoted heredoc is injected directly into the generated wpa_supplicant configuration, causing the robot to join an attacker-controlled hotspot. Finally, the attacker sends a 1,050-byte SSID payload against the 500-byte wifi_ssid buffer in btgatt-server's BLE Wi-Fi SSID handler, an out-of-bounds write (CWE-787) that corrupts a function-pointer/cleanup structure in the process's .bss segment; when the corrupted event loop tears down, it invokes system() with an attacker-supplied command as root, and the backgrounded shell survives the ensuing btgatt-server crash.

CVE-2026-76639 (network-adjacent path, CVSS v3.1 8.8 HIGH / CVSS v4.0 8.7 HIGH) reaches root by a different route: an unauthenticated WebRTC-to-DDS bridge listening on TCP/9991 exposes the robot's internal DDS bus (domain 0, no authentication/encryption, RTPS discovery on multicast 239.255.0.1:7400) to any network-adjacent client. The bridge, combined with a statically stored, world-readable AES-128 key, allows an attacker to invoke the chat_go AI/knowledge-upload DDS service (CONFIG_API_ID_UPLOAD_KNOWLEDGE, id 1006) with a path-traversal filename (CWE-22) to write an attacker-controlled file into a directory whitelisted for bashrunner. Restarting/triggering bashrunner then executes the planted file as root. Both chains were reproduced across four physical G1 EDU units on firmware through V1.5.2.

Separately, the researcher's Android companion-app analysis found the G1's AES key leaking in plaintext to the app's WebView via the RTC_Start call and via BLE-timestamp diagnostic logging before the handshake completes, and bypassed the app's Baidu Jiagu packing via Frida/frida-dexdump runtime DEX extraction, recovering a hardcoded APK signing secret. Firmware images are shipped as TEA-ECB-encrypted .upk archives; the key schedule uses a plaintext 4-byte seed at offset 0x1C combined with hardcoded constants 0x6e35ba0c and 0x9a8b7c6e across 16 TEA rounds (delta 0x9E3779B9), which the researcher broke to extract and reverse firmware.

Unitree added an account-to-robot ownership check on the /device/bindExtData cloud endpoint in July 2026, ahead of public disclosure, closing the cloud-oracle key-recovery path; no confirmed patched Locomotion PC firmware version had been publicly identified as of disclosure, and the researcher noted status reflects the tested builds, not necessarily Unitree's current shipping state. The researcher characterized the BLE chain as wormable: a compromised G1 could be used to relay the same exploit to other vulnerable G1 units within Bluetooth range. Total bug bounty paid was $6,700 ($5,000 reported by one outlet for the combined submission, $4,000 + $1,000 per the researcher's own breakdown). Neither CVE is listed in the CISA KEV catalog and there is no evidence of in-the-wild exploitation; both are public PoC / coordinated disclosure.

MITRE ATT&CK techniques by tactic:

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery; T1518 Software Discovery

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078.004 Valid Accounts; T1091 Replication Through Removable Media; T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services; T1570 Lateral Tool Transfer

Credential Access

T1528 Steal Application Access Token; T1552.001 Unsecured Credentials; T1552.004 Unsecured Credentials: Private Keys

Impact

T1529 System Shutdown/Reboot

Reconnaissance

T1595.002 Active Scanning

Remediation for UniBLEed humanoid robot Bluetooth RCE

Patches

  • Unitree added an account-to-robot ownership check on the /device/bindExtData cloud endpoint (July 2026, pre-disclosure)
  • No confirmed patched Locomotion PC firmware version publicly verified as of 2026-08-27 disclosure

Immediate actions

  • Restrict physical and Bluetooth (BLE) proximity access to deployed Unitree G1/G1 EDU units
  • Isolate robot management and provisioning networks from untrusted or general-purpose enterprise networks
  • Block/firewall inbound TCP/9991 (WebRTC-to-DDS bridge) from untrusted network segments
  • Review and restrict Unitree cloud account access controls tied to robot ownership/binding
  • Treat any G1 unit that has been in untrusted BLE or network range as potentially compromised pending firmware/log review

Workarounds

  • Disable or physically shield BLE radios on G1 units when not actively provisioning
  • Avoid using shared/free Unitree cloud accounts for robot binding operations
  • Monitor for unexpected Wi-Fi network associations or wpa_supplicant configuration changes on Locomotion PCs

Longer-term hardening

  • Apply Unitree firmware updates once a confirmed-patched Locomotion PC build is published and verified
  • Require BLE pairing/authentication on all GATT write characteristics (eliminate unauthenticated 0xFFE2-style writes)
  • Enforce account-to-device ownership verification on all cloud key-decryption/oracle endpoints
  • Authenticate and encrypt the internal DDS bus (domain 0) rather than relying on network position
  • Add bounds checking to BLE Wi-Fi SSID/credential handlers in btgatt-server and fuzz the BLE GATT server
  • Sandbox/whitelist-harden the bashrunner execution path against path traversal from AI/knowledge-upload services

Affected and fixed versions

  • Unitree Robotics — G1 EDU Humanoid Robot (Locomotion PC)
    Vulnerable versions: through V1.5.2
    Fixed in: not publicly confirmed as of 2026-08-27
  • Unitree Robotics — Unitree companion Android application
    Vulnerable versions: tested build, version unspecified
    Fixed in: unconfirmed

Timeline of UniBLEed humanoid robot Bluetooth RCE

Last updated · revalidated 1× · latest source

  • Researcher locked-ioc-11 receives a Unitree G1 EDU unit and begins security testing.
  • Researcher Boschko breaks the Unitree G1 firmware .upk TEA-ECB encryption scheme, enabling firmware extraction and reverse engineering.
  • First root RCE (chat_go path-traversal into bashrunner, later CVE-2026-76639) achieved against the G1 EDU Locomotion PC.
  • Unitree verifies the first reported root RCE chain (CVE-2026-76639) during coordinated disclosure.
  • Cloud key-recovery oracle identified: /device/bindExtData on global-robot-api.unitree.com decrypts a robot's AES key for any authenticated Unitree account without verifying ownership.
  • Second root RCE (unpaired BLE GATT write chained through cloud AES-key oracle and btgatt-server buffer overflow, later CVE-2026-76640) discovered.
  • Unitree verifies the second reported root RCE chain (CVE-2026-76640).
  • Unitree adds an account-to-robot ownership check on the /device/bindExtData cloud endpoint, closing the cloud key-recovery oracle ahead of public disclosure.
  • Unitree pays a combined $6,700 bug bounty for the two reported chains.
  • CVE-2026-76639 and CVE-2026-76640 formally assigned.
  • CVE-2026-76640 published in the NVD (CVSS 3.1: 7.5) covering the BLE GATT buffer-overflow RCE.
  • CVE-2026-76639 published in the NVD (CVSS 3.1: 8.8) covering the chat_go/bashrunner path-traversal RCE.
  • Boschko (Olivier Laflamme) publicly discloses locked-ioc-19 with a technical writeup at boschko.ca and a PoC toolkit on GitHub (OlivierLaflamme/locked-ioc-19).
  • Cyber Security News, The Hacker News, GBHackers, SC Media, and other outlets publish coverage of the disclosure.

Update history

Sources cited for UniBLEed humanoid robot Bluetooth RCE

Previous and next in vulnerability

Further reading

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats