Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-76640— Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack

Quick assessment

Affected
Unitree Robotics G1 EDU
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

宇树科技（Unitree）G1 EDU 机器人固件（版本至 1.5.2）中的 BLE GATT 服务和 WiFi 配网（provisioning）协议栈存在多个可串联利用的漏洞。未认证的近距离攻击者无需配对或凭据，可通过利用 WiFi 配网脚本中的未加引号的 here-doc 变量漏洞，以及 SSID 块累加器中的缓冲区溢出漏洞，实现以 root 权限执行代码。 攻击者可构造特定的 BLE 写入操作，在固定的 BSS 缓冲区上通过多个 BLE 连接累积写入以触发溢出，从而破坏相邻的主循环函数指针分派表项；该表项随后

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76640

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack
Source: CVE Program / CVE List V5
Vulnerability Description
Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi provisioning script and a buffer overflow in the SSID chunk accumulator. Attackers can send crafted BLE writes to overflow a fixed BSS buffer across BLE connections, corrupting an adjacent mainloop function pointer dispatch entry that is subsequently invoked by the cleanup path passing attacker-controlled data to system() as uid 0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unitree Robotics G1 EDU 0 ~ 1.5.2 -

II. Public POCs for CVE-2026-76640

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-76640

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-76640 (1)

Exploits & Public PoCs for CVE-2026-76640 (1)

Other References for CVE-2026-76640 (1)

IV. Related Vulnerabilities

Same product: G1 EDU
Same vendor: Unitree Robotics
Same weakness: CWE-787

V. Comments for CVE-2026-76640

No comments yet

Leave a comment