CVE-2026-76639: high-severity vulnerability in Unitree Robotics G1 EDU
Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.7epss 0.7%
Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, plant a malicious payload in its script execution directory via path traversal, and trigger execution of that payload as uid 0 through the bashrunner shell subprocess.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Unitree Robotics · G1 EDUpublic PoCs found — 2
cve_referencegithub.com/OlivierLaflamme/UniBLEed★ 8cve_referenceboschko.ca/g1-ble-rce/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Unitree Robotics G1 EDU
In the same product, most dangerous first.