Critical Unitree G1 Robot Vulnerability Lets Attackers Take Full Control

Key Takeaways

• A series of critical vulnerabilities, collectively dubbed UniBLEed, have been discovered in Unitree G1 humanoid robots.
• The flaws allow attackers within Bluetooth range to gain root-level control over the robot’s locomotion computer, affecting movement, cameras, and other peripherals.
• The attack chain involves exploiting Bluetooth Low Energy, Unitree’s cloud API, and Wi-Fi provisioning systems.
• Unitree has reportedly released patches, including internal fixes, for most or all of the identified issues.

Full Control Over Unitree G1 Robots Achieved Through Bluetooth Vulnerabilities

A sophisticated attack methodology has been uncovered, enabling threat actors within Bluetooth proximity to seize complete control of Unitree G1 humanoid robots. This critical vulnerability grants root-level code execution on the robot’s locomotion computer, which governs essential hardware functions such as movement, integrated cameras, speakers, and voice capabilities.

The research, termed “UniBLEed,” details a multi-stage exploit that leverages weaknesses across Bluetooth Low Energy (BLE), Unitree’s cloud application programming interface (API), its Wi-Fi provisioning system, and various services operating within the robot’s Linux-based control environment.

Critical Vulnerabilities Assigned CVEs

The identified attack vectors have been assigned CVE-2026-76639 and CVE-2026-76640. Researchers successfully replicated the most severe attack chain on four different Unitree G1 robots. This primary chain initiates with a Bluetooth service that permits write operations without requiring prior Bluetooth pairing.

An attacker’s nearby device can transmit a cleartext request to a Generic Attribute Profile (GATT) characteristic, specifically 0xFFE2. In response, the robot sends an encrypted bootstrap package.

This package contains crucial data necessary to reconstruct the robot’s unique AES-128 encryption key. However, this key is initially protected using RSA encryption.

Cloud API Authorization Flaw Exposed Encryption Keys

A significant vulnerability emerged from Unitree’s cloud endpoint, known as devicebindExtData. This endpoint was found to decrypt the aforementioned bootstrap package data for any authenticated Unitree account, critically failing to verify that the requesting account actually owned the targeted robot. This authorization bypass allowed an attacker to create or utilize a free Unitree account, capture the encrypted Bluetooth response and serial number from a nearby G1 robot, submit this information to the cloud API, and subsequently retrieve the device-specific AES key.

This issue stemmed from an authorization failure rather than an authentication failure. While the API correctly validated user accounts, it neglected to establish and verify the ownership relationship between the authenticated account and the specific robot in question.

Wi-Fi Provisioning and Buffer Overflow Exploits

Once the AES key was compromised, attackers could complete the G1’s Bluetooth application-level handshake and issue Wi-Fi configuration commands. Further investigation by researchers revealed that the robot’s Wi-Fi setup script was susceptible to manipulation due to insecure handling of Wi-Fi credentials.

By providing a maliciously crafted, excessively long password, an attacker could force the script into a manual configuration mode. This allowed for the injection of additional network blocks into the generated wpa_supplicant configuration, ultimately compelling the robot to connect to an attacker-controlled Wi-Fi hotspot.

From this compromised network position, the attack chain exploited another flaw within the G1’s Bluetooth server. A Wi-Fi SSID handler copied incoming data into a fixed-size 500-byte buffer without adequately validating the total received data length.

This enabled an attacker to transmit a 1,050-byte payload across one or more Bluetooth connections, leading to memory corruption in adjacent areas of the server process. The Boschko research states that this corruption could modify an event-loop cleanup structure, ultimately causing the process to execute a command via system() with root privileges.

Additional Root RCE Chains Identified

A separate root code execution chain, identified as CVE-2026-76639, impacted the robot’s ChatGo AI service and BashRunner service. Attackers who had gained access to the robot’s internal network could exploit a path-traversal vulnerability within ChatGPT’s knowledge-upload feature. This allowed them to write arbitrary files into a directory trusted by the BashRunner service. Upon restarting the service, BashRunner would then execute the attacker-created file with root privileges.

The implications of these vulnerabilities are severe, as the targeted locomotion computer operates Linux services with root privileges and controls functions critical to the physical operation of the robot. Researchers also cautioned that the Bluetooth attack chain possessed wormable characteristics, meaning a compromised G1 robot could potentially propagate the exploit to other vulnerable robots within Bluetooth range.

Patches Issued by Unitree

Unitree reportedly implemented an ownership-binding verification check for its cloud decryption endpoint in July 2026, prior to the public disclosure of these findings. The researcher confirmed that Unitree has released patches, including internal fixes, addressing most or all of the reported issues at the time of publication.

What You Should Do

• Apply all available firmware updates from Unitree for your G1 robots immediately.
• Ensure your robot’s mobile application is updated to the latest version.
• Avoid exposing robots to untrusted or unknown Bluetooth devices.
• Isolate robot management networks from sensitive enterprise systems to limit potential lateral movement in case of compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.