Skip to finding

from bug to shell.

Bluetooth — Unitree

A nearby BLE client with the target’s bound account or device key can still reach root on a G1 EDU robot.

Unitree blocked the cheaper arbitrary-account route, but not the credential-bound BLE and firmware primitives.

Sources

ResearchUniBLEed: Root RCE on Any Unitree G1 Humanoid Robot Code / PoCGitHub - OlivierLaflamme/UniBLEed: Unitree G1 RCE PoC & Scripts (CVE-2026-76639 / CVE-2026-76640) technical details at boschko.ca/g1-ble-rce/ · GitHub

Share this finding

Email Hacker News Reddit Mastodon Bluesky X LinkedIn Facebook Copy link

Read the full daily brief →

Every finding here carries a source that was checked before it published. If something is wrong, write to admin@fullchain.sh — corrections are published on the day they affect.

Wednesday, September 2, 2026