UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in Unitree G1 EDU Humanoid Robot (CVE-2026-76639, CVE-2026-76640) — Threadlinqs Intelligence
As of 2026-08-29, UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in Unitree G1 EDU Humanoid Robot (CVE-2026-76639, CVE-2026-76640) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 19 indicators of compromise.
Threat ID: TL-2026-2196 · Severity: CRITICAL · CVSS: 8.8 · Status: ACTIVE · Category: VULNERABILITY
Updated: 2026-08-29 · revalidated 1× · latest source
Researcher Olivier Laflamme ("Boschko") disclosed two chained root-RCE vulnerability chains in the Unitree G1 EDU humanoid robot's Locomotion PC. CVE-2026-76640 lets a nearby attacker use an unpaired
UniBLEed is a five-stage exploit chain against the Unitree G1 EDU humanoid robot's Rockchip RK3588 Locomotion PC (Linux 5.10.176-rt86+), published by researcher Olivier Laflamme (handle Boschko) on 2026-08-27 with a companion PoC toolkit and technical writeup. Two CVEs were assigned to the underlying flaws.
CVE-2026-76640 (BLE path, CVSS v3.1 7.5 HIGH / CVSS v4.0 7.7 HIGH) begins with an unpaired write to BLE GATT characteristic 0xFFE2 (service 0xFFE0, notify channel 0xFFE1) using opcode 0xF2, which triggers the robot to return an RSA-OAEP-SHA256-wrapped AES-128 bootstrap key without any authentication or pairing. The attacker then submits this wrapped blob and the robot's serial number to Unitree's cloud endpoint POST /device/bindExtData on global-robot-api.unitree.com using any free, unrelated Unitree account; the endpoint decrypts and returns the plaintext AES-128 key because it never verifies that the requesting account owns the target robot's serial number. With the recovered key, the attacker completes the BLE handshake and sends Wi-Fi provisioning data: a 121-byte PSK/credential value forces /unitree/module/network_manager/wpa_connect.sh into a fallback path where unescaped data inside an unquoted heredoc is injected directly into the generated wpa_supplicant configuration, causing the robot to join an attacker-controlled hotspot. Finally, the attacker sends a 1,050-byte SSID payload against the 500-byte wifi_ssid buffer in btgatt-server's BLE Wi-Fi SSID handler, an out-of-bounds write (CWE-787) that corrupts a function-pointer/cleanup structure in the process's .bss segment; when the corrupted event loop tears down, it invokes system() with an attacker-supplied command as root, and the backgrounded shell survives the ensuing btgatt-server crash.
CVE-2026-76639 (network-adjacent path, CVSS v3.1 8.8 HIGH / CVSS v4.0 8.7 HIGH) reaches root by a different route: an unauthenticated WebRTC-to-DDS bridge listening on TCP/9991 exposes the robot's internal DDS bus (domain 0, no authentication/encryption, RTPS discovery on multicast 239.255.0.1:7400) to any network-adjacent client. The bridge, combined with a statically stored, world-readable AES-128 key, allows an attacker to invoke the chat_go AI/knowledge-upload DDS service (CONFIG_API_ID_UPLOAD_KNOWLEDGE, id 1006) with a path-traversal filename (CWE-22) to write an attacker-controlled file into a directory whitelisted for bashrunner. Restarting/triggering bashrunner then executes the planted file as root. Both chains were reproduced across four physical G1 EDU units on firmware through V1.5.2.
Separately, the researcher's Android companion-app analysis found the G1's AES key leaking in plaintext to the app's WebView via the RTC_Start call and via BLE-timestamp diagnostic logging before the handshake completes, and bypassed the app's Baidu Jiagu packing via Frida/frida-dexdump runtime DEX extraction, recovering a hardcoded APK signing secret. Firmware images are shipped as TEA-ECB-encrypted .upk archives; the key schedule uses a plaintext 4-byte seed at offset 0x1C combined with hardcoded constants 0x6e35ba0c and 0x9a8b7c6e across 16 TEA rounds (delta 0x9E3779B9), which the researcher broke to extract and reverse firmware.
Unitree added an account-to-robot ownership check on the /device/bindExtData cloud endpoint in July 2026, ahead of public disclosure, closing the cloud-oracle key-recovery path; no confirmed patched Locomotion PC firmware version had been publicly identified as of disclosure, and the researcher noted status reflects the tested builds, not necessarily Unitree's current shipping state. The researcher characterized the BLE chain as wormable: a compromised G1 could be used to relay the same exploit to other vulnerable G1 units within Bluetooth range. Total bug bounty paid was $6,700 ($5,000 reported by one outlet for the combined submission, $4,000 + $1,000 per the researcher's own breakdown). Neither CVE is listed in the CISA KEV catalog and there is no ev
Weaknesses (CWE)
CWE-306, CWE-787, CWE-22
Target sectors: robotics, research and academia, manufacturing, technology
Target regions: Global
Timeline
- Researcher Olivier Laflamme (Boschko) receives a Unitree G1 EDU unit and begins security testing.
- Researcher Boschko breaks the Unitree G1 firmware .upk TEA-ECB encryption scheme, enabling firmware extraction and reverse engineering.
- First root RCE (chat_go path-traversal into bashrunner, later CVE-2026-76639) achieved against the G1 EDU Locomotion PC.
- Unitree verifies the first reported root RCE chain (CVE-2026-76639) during coordinated disclosure.
- Cloud key-recovery oracle identified: /device/bindExtData on global-robot-api.unitree.com decrypts a robot's AES key for any authenticated Unitree account without verifying ownership.
- Second root RCE (unpaired BLE GATT write chained through cloud AES-key oracle and btgatt-server buffer overflow, later CVE-2026-76640) discovered.
- Unitree verifies the second reported root RCE chain (CVE-2026-76640).
- Unitree adds an account-to-robot ownership check on the /device/bindExtData cloud endpoint, closing the cloud key-recovery oracle ahead of public disclosure.
- Unitree pays a combined $6,700 bug bounty for the two reported chains.
- CVE-2026-76639 and CVE-2026-76640 formally assigned.
- Boschko (Olivier Laflamme) publicly discloses UniBLEed with a technical writeup at boschko.ca and a PoC toolkit on GitHub (OlivierLaflamme/UniBLEed).
- CVE-2026-76639 published in the NVD (CVSS 3.1: 8.8) covering the chat_go/bashrunner path-traversal RCE.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 19 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-76639, CVE-2026-76640, T1190, T1091, T1203, T1059, T1528, T1552.004, T1518, T1071, T1529, T1595.002
