Unauthenticated Remote Code Execution in Unitree G1 EDU Firmware
CVE-2026-76639

8.7HIGH

Key Information:

Vendor: Unitree Robotics
Status: G1 Edu
Vendor: CVE Published:; 27 August 2026

🔔 Create Unitree Robotics Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-76639?

The Unitree G1 EDU firmware version 1.5.2 contains a vulnerability that allows network-adjacent attackers to execute arbitrary commands with root privileges. This risk arises from multiple interconnected weaknesses: the presence of an unauthenticated WebRTC-to-DDS bridge accessible via TCP port 9991, a static AES-128 key that is improperly secured with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. By exploiting these issues, an attacker can publish DDS control messages to restart the bashrunner service, utilize path traversal to place malicious scripts in the execution directory, and initiate the execution of these scripts with elevated privileges through the bashrunner shell.

Affected Version(s)

G1 EDU 0 <= 1.5.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-76639 - Proof of Concept

CVE-2026-76639 - Proof of Concept
Created by OlivierLaflamme