Skip to finding

from bug to shell.

Physical — Unitree

Physical Ethernet access can reach a published WebRTC-to-DDS and bashrunner chain that executes as root on a G1 EDU robot.

No shipped fixed firmware version was identified.

Sources

ResearchUniBLEed: Root RCE on Any Unitree G1 Humanoid Robot Code / PoCGitHub - OlivierLaflamme/UniBLEed: Unitree G1 RCE PoC & Scripts (CVE-2026-76639 / CVE-2026-76640) technical details at boschko.ca/g1-ble-rce/ · GitHub

Share this finding

Email Hacker News Reddit Mastodon Bluesky X LinkedIn Facebook Copy link

Read the full daily brief →

Every finding here carries a source that was checked before it published. If something is wrong, write to admin@fullchain.sh — corrections are published on the day they affect.

Wednesday, September 2, 2026