EUVD-2026-67165
GHSA-q24f-vr89-8h97
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network vector (AV:A) required; no authentication or interaction needed; full CIA impact on the robot; no scope change to other systems confirmed.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, plant a malicious payload in its script execution directory via path traversal, and trigger execution of that payload as uid 0 through the bashrunner shell subprocess.
AnalysisAI
Unauthenticated remote code execution in Unitree G1 EDU firmware through 1.5.2 allows any network-adjacent attacker to gain a root shell on the robot by chaining three design flaws without credentials or user interaction. The attack exploits an open WebRTC-to-DDS bridge on TCP port 9991, a hardcoded world-readable AES-128 key, and a path traversal flaw in the chat_go knowledge upload API to plant and execute arbitrary scripts as uid 0 via the bashrunner service. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be network-adjacent - on the same LAN, broadcast domain, or Wi-Fi segment as the G1 EDU robot; remote internet-based exploitation is not possible due to the AV:A vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 is driven by AV:A (adjacent network), AC:L, PR:N, UI:N, and full VC/VI/VA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on the same university or lab Wi-Fi network as a Unitree G1 EDU robot scans for TCP port 9991, connects to the unauthenticated WebRTC-to-DDS bridge, and uses the publicly available UniBLEed PoC (https://github.com/OlivierLaflamme/UniBLEed) to publish DDS control messages. The attacker reads the world-readable AES-128 key from the robot's filesystem (obtained via any read primitive or prior access), crafts a path-traversal upload request to the chat_go API to write a malicious shell script into the bashrunner execution directory, then triggers a bashrunner service restart via DDS - causing the planted script to execute as root, yielding a persistent root shell on the robot platform. |
| Remediation | No vendor-released patch has been identified at the time of analysis; Unitree Robotics has not published a firmware advisory or fixed version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Unitree G1 EDU robots and confirm firmware versions; immediately isolate any system running 1.5.2 or earlier to air-gapped networks or shut down if not critical; scan network for port 9991 probe attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today