Unitree G1 EDU CVE-2026-76639

Exploitation requires the attacker to be network-adjacent - on the same LAN, broadcast domain, or Wi-Fi segment as the G1 EDU robot; remote internet-based exploitation is not possible due to the AV:A vector. Within that constraint, no authentication is required at any stage of the chain. The three prerequisite conditions are all default states in firmware through 1.5.2: the WebRTC-to-DDS bridge must be running on TCP port 9991 (default-enabled per the firmware design), the static AES-128 key must be present on the filesystem with world-readable permissions (a hardcoded design flaw), and the chat_go knowledge upload API must be accessible on the robot (default service). No special non-default configuration is needed - the attack targets the default deployment state. The primary factor limiting exploitation is the requirement for adjacent-network positioning; once that is satisfied, exploitation is unauthenticated, requires no user interaction, and is supported by public PoC code, making it highly reliable.

The CVSS 4.0 score of 8.7 is driven by AV:A (adjacent network), AC:L, PR:N, UI:N, and full VC/VI/VA impact. The adjacent-network vector is the single most important limiting signal - internet-facing exploitation is not possible; the attacker must be on the same broadcast domain, VLAN, or Wi-Fi segment as the robot. In university robotics labs, shared research networks, or demo environments this condition is readily met. The attack complexity is nominally low: while three weaknesses must be chained, each step is thoroughly documented in a public writeup (boschko.ca/g1-ble-rce/) and a working PoC (UniBLEed, GitHub), meaning reliable exploitation does not require original research. No CISA KEV listing has been observed, so confirmed in-the-wild exploitation is unverified, but publicly available exploit code significantly narrows the gap between disclosure and operational abuse. The root-level shell access impact is maximum - full confidentiality, integrity, and availability of the robot platform are compromised, with physical actuation implications if drive systems are accessible via DDS. For G1 EDU operators, this is a genuine priority that should not be dismissed on the basis of the non-internet AV:A vector alone.

An attacker on the same university or lab Wi-Fi network as a Unitree G1 EDU robot scans for TCP port 9991, connects to the unauthenticated WebRTC-to-DDS bridge, and uses the publicly available UniBLEed PoC (https://github.com/OlivierLaflamme/UniBLEed) to publish DDS control messages. The attacker reads the world-readable AES-128 key from the robot's filesystem (obtained via any read primitive or prior access), crafts a path-traversal upload request to the chat_go API to write a malicious shell script into the bashrunner execution directory, then triggers a bashrunner service restart via DDS - causing the planted script to execute as root, yielding a persistent root shell on the robot platform.