# Root RCE Vulnerabilities Uncovered in Unitree G1 EDU Robots  Cybersecurity researcher **Olivier Laflamme** has revealed two distinct root remote code execution (RCE) chains impacting the **Unitree G1 EDU** robot. These vulnerabilities include a **Bluetooth Low Energy (BLE)** path capable of achieving root access on the robot's Locomotion PC. ## Identified Vulnerabilities The disclosed flaws are identified as **CVE-2026-76639** and **CVE-2026-76640**. The former involves a network-adjacent attack vector leveraging `chat_go` and `bashrunner`, while the latter originates from BLE proximity. ### Unconfirmed Remediation As of the disclosure, **Unitree** has not publicly verified a specific fixed firmware release, leaving **G1 EDU** owners without clear guidance on remediation. **Laflamme** noted that **Unitree** addressed a cloud account-to-robot ownership check in July 2026. Currently, cloud-assisted routes necessitate an account bound to the target **G1 EDU** or pre-existing key material. **Laflamme** published his comprehensive research on August 27, 2026, detailing these two independent root-RCE paths. His testing involved upgrading the robot to **V1.5.2**, though this doesn't definitively confirm **V1.5.1.1** as affected. ## Technical Breakdown of CVE-2026-76639 In his [technical disclosure](https://boschko.ca/g1-ble-rce/), **Laflamme** explained that **CVE-2026-76639** exploits a path-traversal condition within `chat_go` to reach `bashrunner`. Successful execution through `bashrunner` grants root code execution on the Locomotion PC. Although an independent RCE, **Laflamme** utilized it as a primitive in demonstrating the separate BLE chain (**CVE-2026-76640**). ## Exploiting CVE-2026-76640 via BLE For **CVE-2026-76640**, the initial BLE write path accepts bootstrap interaction without requiring Bluetooth pairing. While the bootstrap material itself remains protected, subsequent Wi-Fi provisioning operations demand an authenticated BLE state from the application. During **Laflamme**'s research, **Unitree**'s cloud service accepted key-recovery requests from valid **Unitree** accounts without verifying robot ownership. This authorization gap allowed accounts to retrieve key material for other **G1 EDU** robots. The recovered key could then establish the authenticated BLE state needed for Wi-Fi provisioning. The attack chain then proceeded to the Wi-Fi provisioning code, where **Laflamme** discovered a buffer overflow that led to root execution on the Locomotion PC. ## Scope and Impact **Laflamme**'s propagation tests were limited to two **G1** robots within a single room. He confirmed in his August 27 disclosure that the cloud authorization fix now disrupts the exact proof-of-concept flow he demonstrated. **Unitree**'s official product page differentiates the **G1** and **G1 EDU** models. The broader applicability of these vulnerabilities to other **Unitree** robots is yet to be confirmed. Ghost Protocol has reached out to **Unitree** for confirmation on fixed firmware versions, affected product scope, and current remediation status, and will update this report with any response.