UniPwn

Unitree Robot BLE Service Command Injection Analysis Author: Bin4ry aka Andreas Makris [email protected] Co-Author: h0stile aka Kevin Finisterre Contributor: legion1581 aka Konstantin Severov from theroboverse helped to fix the payload for the injection and proved it with a fully working PoC...

UniBLEed

UniBLEed Unitree G1 RCE PoC & Scripts CVE-2026-76639 / CVE-2026-76640 technical details at boschko.ca/g1-ble-rce/ Use this repository only with robots, accounts, and networks you are authorized to test. The active chains can change the robot's WiFi configuration, stop or restart services, crash...

CVE-2023-38873-G1

🚨 G1 = A05:2021 – Security Misconfiguration ClickJacking ⚠️ Base Score: 6.5 MEDIUM Scale: CVSS ⚠️ 📌 Description This repository demonstrates a Clickjacking security flaw present on the G1 website. The vulnerability allows an attacker to load the site inside an iframe , overlaying malicious elements...

PT-2026-104570

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Description An issue exists in the BLS12 381BasicScheme.keyValidate function, affecting BLSPublicKeyParameters and the verify and aggregateVerify methods of BasicScheme, MessageAugmentation, and...

Rocky Linux 10.0 [CIQ] Security Update: java-21-openjdk / java-21-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_10873)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202510873 advisory. JDK: Better Glyph drawing CVE-2025-30749 JDK: Enhance TLS protocol support CVE-2025-30754 JDK: Improve HTTP client header handling CVE-2025-50059 JDK:...

Tenda G1 Router Command Execution

The vulnerability of the /etcro/shadow file in the Tenda G1 router microprogramming system is related to the use of fixed password encoding. Exploiting this vulnerability allows an attacker to execute arbitrary commands on behalf of the root user...

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Security researcher Olivier Laflamme has disclosed two independent root remote code execution RCE chains affecting the Unitree G1 EDU , including a Bluetooth Low Energy BLE path that can reach root on the robot's Locomotion PC. The flaws are tracked asCVE-2026-76639 and CVE-2026-76640 , with the...

CVE-2026-76639

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored wi...

CVE-2026-76640

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi...

CVE-2026-76640

Unitree G1 EDU firmware through 1.5.2 contains chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow an unauthenticated proximate attacker to achieve root code execution (uid 0) without pairing or credentials. The root cause involves an unquoted heredoc variable in...

EUVD-2026-67166

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi...

CVE-2026-76640 Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi...

EUVD-2026-67165

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored wi...

CVE-2026-76639 Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored wi...

CVE-2026-76639

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability scored CVSS 8.8 (HIGH) . An attacker on an adjacent network can chain three weaknesses—an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key with world-readable permissio...

PT-2026-82733

Name of the Vulnerable Software and Affected Versions Unitree G1 EDU firmware versions prior to 1.5.3 Description Multiple chained issues exist in the BLE GATT server and WiFi provisioning stack. Unauthenticated proximate attackers can achieve root code execution without pairing or credentials...

PT-2026-82732

Name of the Vulnerable Software and Affected Versions Unitree G1 EDU firmware versions prior to 1.5.3 Description An unauthenticated remote code execution flaw allows network-adjacent attackers to execute arbitrary commands as root. This is achieved by chaining three weaknesses: an unauthenticate...

CVE-2026-76640: Out-of-bounds Write

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi...

CVE-2026-76639: Improper Limitation of a Pathname to a Restricted Directory

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored wi...

ANT-2026-7R9KHDAS · cloudflare/circl · Signature Verification Bypass / Universal Forgery

other critical Severity Claude critical · Security research firm - · Maintainer - REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-7R9KHDAS: CIRCL sign/bls: universal signature forgery in KeyG2SigG1 via G1-infinity point In the KeyG2SigG1 configuration of...