Unitree G1 EDU CVE-2026-76640

Attackers must be within BLE proximity of the target robot, typically under 10 meters and line-of-sight dependent. No pairing, authentication, or credentials of any kind are required - the BLE GATT server accepts writes from unpaired, unauthenticated devices, which is the condition enabling PR:N. The robot must be running firmware through version 1.5.2 with the BLE GATT server active and the WiFi provisioning stack loaded; available data indicates this is the default operational configuration, not a non-default mode. Exploitation requires successfully executing a multi-step chain - overflowing the BSS buffer, achieving precise corruption of the adjacent function pointer, and triggering the cleanup path - which is why AC:H is assigned; single-packet exploitation is not indicated by the description. No user interaction on the robot side is required. Limiting factors include the physical proximity constraint, the high chaining complexity, and the requirement that BLE remains active and the provisioning stack is running at time of attack.

Real-world risk is moderate-to-significant for any environment deploying Unitree G1 EDU robots within BLE range of untrusted parties. The CVSS 4.0 score of 7.7 (AV:A/AC:H/PR:N/UI:N) correctly reflects that exploitation requires physical proximity - BLE range, typically under 10 meters - and involves a high-complexity multi-step chain, which meaningfully limits opportunistic mass exploitation. However, the publicly available UniBLEed proof-of-concept on GitHub dramatically lowers the skill threshold, and the end result is an unconditional root shell on the robot platform. The vulnerability is not in CISA KEV and no EPSS data was provided, suggesting exploitation has not yet been observed at scale; nonetheless, the gap between KEV absence and public POC availability is a meaningful warning sign that targeted exploitation may emerge before widespread detection. Research institutions, warehouses, and manufacturing environments where G1 EDU units operate near untrusted personnel should prioritize physical access controls and firmware updates, given the no-authentication, no-pairing exploitation path.

An attacker positions themselves within BLE range of an operational Unitree G1 EDU robot - no pairing, account, or prior access required - and uses the UniBLEed tool to send a sequence of crafted BLE GATT writes targeting the SSID chunk accumulator, overflowing the fixed BSS buffer and overwriting the adjacent function pointer dispatch table. When the BLE connection cleanup path fires, the robot firmware executes attacker-supplied shell commands as root, yielding full persistent control of the robotic platform. Because the proof-of-concept is publicly available, this attack is within reach of non-expert adversaries who can achieve physical proximity.