# UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in Unitree G1 EDU Humanoid Robot (CVE-2026-76639, CVE-2026-76640)

> Researcher Olivier Laflamme ("Boschko") disclosed two chained root-RCE vulnerability chains in the Unitree G1 EDU humanoid robot's Locomotion PC. CVE-2026-76640 lets a nearby attacker use an unpaired BLE GATT write to recover the robot's AES-128 key via a cloud authorization bypass, hijack its Wi-Fi provisioning, and trigger a buffer overflow in btgatt-server to execute commands as root without pairing or credentials. CVE-2026-76639 reaches the same root outcome over the network via an unauthenticated WebRTC-to-DDS bridge and a path-traversal in the chat_go AI service's knowledge-upload path into bashrunner.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-29T10:01:07.175Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2196
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-unibleed-humanoid-robot-bluetooth-rce-tl-2026-2196.webp?v=458097c0 (Threadlinqs threat intel: CVE-2026-76640 UniBLEed Unitree G1 RCE: Detection & IOCs (TL-2026-2196) — Critical severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-2196
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)
- **CVEs:** CVE-2026-76639, CVE-2026-76640

## Description

UniBLEed is a five-stage exploit chain against the Unitree G1 EDU humanoid robot's Rockchip RK3588 Locomotion PC (Linux 5.10.176-rt86+), published by researcher Olivier Laflamme (handle Boschko) on 2026-08-27 with a companion PoC toolkit and technical writeup. Two CVEs were assigned to the underlying flaws.

CVE-2026-76640 (BLE path, CVSS v3.1 7.5 HIGH / CVSS v4.0 7.7 HIGH) begins with an unpaired write to BLE GATT characteristic 0xFFE2 (service 0xFFE0, notify channel 0xFFE1) using opcode 0xF2, which triggers the robot to return an RSA-OAEP-SHA256-wrapped AES-128 bootstrap key without any authentication or pairing. The attacker then submits this wrapped blob and the robot's serial number to Unitree's cloud endpoint POST /device/bindExtData on global-robot-api.unitree.com using any free, unrelated Unitree account; the endpoint decrypts and returns the plaintext AES-128 key because it never verifies that the requesting account owns the target robot's serial number. With the recovered key, the attacker completes the BLE handshake and sends Wi-Fi provisioning data: a 121-byte PSK/credential value forces /unitree/module/network_manager/wpa_connect.sh into a fallback path where unescaped data inside an unquoted heredoc is injected directly into the generated wpa_supplicant configuration, causing the robot to join an attacker-controlled hotspot. Finally, the attacker sends a 1,050-byte SSID payload against the 500-byte wifi_ssid buffer in btgatt-server's BLE Wi-Fi SSID handler, an out-of-bounds write (CWE-787) that corrupts a function-pointer/cleanup structure in the process's .bss segment; when the corrupted event loop tears down, it invokes system() with an attacker-supplied command as root, and the backgrounded shell survives the ensuing btgatt-server crash.

CVE-2026-76639 (network-adjacent path, CVSS v3.1 8.8 HIGH / CVSS v4.0 8.7 HIGH) reaches root by a different route: an unauthenticated WebRTC-to-DDS bridge listening on TCP/9991 exposes the robot's internal DDS bus (domain 0, no authentication/encryption, RTPS discovery on multicast 239.255.0.1:7400) to any network-adjacent client. The bridge, combined with a statically stored, world-readable AES-128 key, allows an attacker to invoke the chat_go AI/knowledge-upload DDS service (CONFIG_API_ID_UPLOAD_KNOWLEDGE, id 1006) with a path-traversal filename (CWE-22) to write an attacker-controlled file into a directory whitelisted for bashrunner. Restarting/triggering bashrunner then executes the planted file as root. Both chains were reproduced across four physical G1 EDU units on firmware through V1.5.2.

Separately, the researcher's Android companion-app analysis found the G1's AES key leaking in plaintext to the app's WebView via the RTC_Start call and via BLE-timestamp diagnostic logging before the handshake completes, and bypassed the app's Baidu Jiagu packing via Frida/frida-dexdump runtime DEX extraction, recovering a hardcoded APK signing secret. Firmware images are shipped as TEA-ECB-encrypted .upk archives; the key schedule uses a plaintext 4-byte seed at offset 0x1C combined with hardcoded constants 0x6e35ba0c and 0x9a8b7c6e across 16 TEA rounds (delta 0x9E3779B9), which the researcher broke to extract and reverse firmware.

Unitree added an account-to-robot ownership check on the /device/bindExtData cloud endpoint in July 2026, ahead of public disclosure, closing the cloud-oracle key-recovery path; no confirmed patched Locomotion PC firmware version had been publicly identified as of disclosure, and the researcher noted status reflects the tested builds, not necessarily Unitree's current shipping state. The researcher characterized the BLE chain as wormable: a compromised G1 could be used to relay the same exploit to other vulnerable G1 units within Bluetooth range. Total bug bounty paid was $6,700 ($5,000 reported by one outlet for the combined submission, $4,000 + $1,000 per the researcher's own breakdown). Neither CVE is listed in the CISA KEV catalog and there is no evidence of in-the-wild exploitation; both are public PoC / coordinated disclosure.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1091 Replication Through Removable Media
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1528 Steal Application Access Token
- T1552.004 Unsecured Credentials: Private Keys
- T1518 Software Discovery
- T1071 Application Layer Protocol
- T1529 System Shutdown/Reboot
- T1595.002 Active Scanning
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1078.004 Valid Accounts
- T1059.004 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1552.001 Unsecured Credentials
- T1210 Exploitation of Remote Services
- T1570 Lateral Tool Transfer

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**UniBLEed: Unpaired BLE GATT Write to Characteristic 0xFFE2 (Unitree G1 Key-Recovery Trigger)** (`TL-2026-2196-SPL-001`)

Detects an unpaired/unauthenticated GATT write to characteristic 0xFFE2 (service 0xFFE0) with opcode 0xF2 against a Unitree G1-class BLE peripheral, as forwarded by a BLE monitoring gateway/sniffer. This is the initial-access primitive of CVE-2026-76640 (UniBLEed): it causes the robot to return an RSA-OAEP-wrapped AES-128 bootstrap key to any nearby device without pairing or credentials.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1091
- **Data sources:** ble_gateway_ids, bluetooth_sniffer
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=ble_iot sourcetype="ble:gatt:write" gatt_service="0xFFE0" gatt_characteristic="0xFFE2" opcode="0xF2"
| eval paired=coalesce(paired,"unknown")
| where paired!="true"
| stats count min(_time) as first_seen max(_time) as last_seen values(peer_mac) as attacker_mac values(target_ble_id) as target_device by src_ip
| where count>=1
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen attacker_mac target_device src_ip count
```

### Microsoft KQL

```kql
BleGattEvents_CL
| where TimeGenerated > ago(24h)
| where GattService_s == "0xFFE0" and GattCharacteristic_s == "0xFFE2" and Opcode_s == "0xF2"
| where PairedState_s != "true"
| summarize WriteCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by PeerMac_s, TargetDeviceId_s
| project FirstSeen, LastSeen, PeerMac_s, TargetDeviceId_s, WriteCount
```

### Sigma

```yaml
title: Unpaired BLE GATT Write to Unitree G1 Characteristic 0xFFE2 (UniBLEed Key Recovery)
id: 7c1a2e10-4f6b-4a9d-9b21-1f2a3c4d5e01
status: experimental
description: Detects an unauthenticated/unpaired GATT write with opcode 0xF2 to characteristic 0xFFE2 (service 0xFFE0) on a Unitree G1-class BLE peripheral, the AES-key-recovery trigger for CVE-2026-76640.
references:
  - https://boschko.ca/g1-ble-rce/
  - https://www.vulncheck.com/advisories/unitree-g1-edu-ble-gatt-rce-via-wifi-provisioning-stack
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
  - attack.initial-access
  - attack.t1091
  - cve.2026.76640
  - attack.tool.unibleed
logsource:
  category: application
  product: ble_gateway
  service: gatt_server
detection:
  selection:
    GattService: '0xFFE0'
    GattCharacteristic: '0xFFE2'
    Opcode: '0xF2'
  filter_paired:
    PairedState: 'true'
  condition: selection and not filter_paired
falsepositives:
  - Legitimate first-time provisioning of a new G1 unit by an authorized technician using the vendor app
level: high
```

**Known false positives:**

- Authorized initial provisioning/pairing of a new G1 unit performed via the official Unitree companion app in a controlled maintenance window

**Tuning notes:** If a fleet-management BLE gateway is deployed, allowlist its MAC/service-tag so its own provisioning writes are excluded; otherwise correlate with a change-management ticket window before alerting.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- UniBLEed: Cross-Account Abuse of Unitree Cloud AES Key Oracle (/device/bindExtData) (locked: unlock with TL Creds)
- UniBLEed: wpa_connect.sh Heredoc Injection via Oversized Wi-Fi Credential (Rogue AP Hijack) (locked: unlock with TL Creds)
- UniBLEed Wormable Propagation: Single Source Writing GATT 0xFFE2 to Multiple G1 Units in Short Window (locked: unlock with TL Creds)
- Unauthenticated Connection to WebRTC-to-DDS Bridge on TCP/9991 (Unitree G1) (locked: unlock with TL Creds)
- chat_go Knowledge-Upload Path Traversal Into bashrunner Whitelisted Directory (CVE-2026-76639) (locked: unlock with TL Creds)
- Persistent Outbound DDS/RTPS Multicast Traffic From Locomotion PC to Non-Fleet Host (Post-Compromise C2) (locked: unlock with TL Creds)
- UniBLEed: btgatt-server wifi_ssid Oversized GATT Payload (Buffer Overflow Trigger, CWE-787) (locked: unlock with TL Creds)
- btgatt-server Crash Followed by Backgrounded Root Shell (Event-Loop Corruption → system() as Root) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- Domain: `firmware-cdn[.]unitree[.]com`
- URL: `hxxps://global-robot-api[.]unitree[.]com/device/bindExtData`
- Domain: `unitree-firmware[.]oss-cn-hangzhou[.]aliyuncs[.]com`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Unitree G1 Robots Vulnerability Let Attackers Gain Complete Control Over Bluetooth](https://cybersecuritynews.com/unitree-g1-robots-over-bluetooth/)
- [UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range](https://boschko.ca/g1-ble-rce/)
- [Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth](https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html)
- [Unitree G1 Humanoid Robot Flaws Allow Unauthenticated Root RCE Over Bluetooth](https://gbhackers.com/unitree-g1-humanoid-robot-flaws/)
- [Two root remote code execution flaws found in Unitree G1 EDU robot](https://www.scworld.com/brief/two-root-remote-code-execution-flaws-found-in-unitree-g1-edu-robot)
- [UniBLEed PoC and exploitation toolkit (GitHub)](https://github.com/OlivierLaflamme/UniBLEed)
- [Unitree G1 EDU BLE GATT RCE via WiFi Provisioning Stack (CVE-2026-76640)](https://www.vulncheck.com/advisories/unitree-g1-edu-ble-gatt-rce-via-wifi-provisioning-stack)
- [Unitree G1 EDU Unauthenticated RCE via DDS Bridge and Path Traversal (CVE-2026-76639)](https://www.vulncheck.com/advisories/unitree-g1-edu-unauthenticated-rce-via-dds-bridge-and-path-traversal)
- [From DDS Packets to Robot Shells: Two RCEs in Unitree Robots (CVE-2026-27509 & CVE-2026-27510)](https://boschko.ca/unitree-go2-rce/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2196