CVE-2026-76640: Out-of-bounds Write in Unitree Robotics G1 EDU
Description
Unitree Robotics G1 EDU firmware up to version 1.5.2 contains multiple chained vulnerabilities in its BLE GATT server and WiFi provisioning stack. These vulnerabilities allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable and a buffer overflow. The attack involves sending crafted BLE writes to overflow a fixed buffer, corrupting a function pointer that is later invoked with root privileges.
CVSS v4.0
Score 7.7high
Affected software
Unitree Robotics
G1 EDU
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-76640 describes multiple chained vulnerabilities in Unitree Robotics G1 EDU firmware through version 1.5.2. The flaws reside in the BLE GATT server and WiFi provisioning stack, specifically an unquoted heredoc variable in the WiFi provisioning script and a buffer overflow in the SSID chunk accumulator. An attacker in physical proximity can send crafted BLE writes to overflow a fixed BSS buffer across BLE connections, corrupting an adjacent mainloop function pointer dispatch entry. This corrupted pointer is invoked during cleanup, passing attacker-controlled data to the system() call running as root (uid 0), resulting in root code execution without any authentication or pairing.
Potential Impact
Successful exploitation results in unauthenticated, proximate attackers gaining root code execution on the affected device. This allows full control over the system with the highest privileges, potentially leading to complete compromise of the device and its functions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-19T14:53:58.575Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a909cffacd9273b49b2d376
Added to database: 08/27/2026, 20:24:31 UTC
Last enriched: 09/08/2026, 10:37:24 UTC
Last updated: 10/11/2026, 06:48:18 UTC
Views: 76
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.