Bluetooth range was enough to root a Unitree G1 — and the keys inside were the maker's

Two vulnerabilities published this week let anyone standing close to a Unitree G1 EDU take full control of it — and among the things they would find inside were live credentials for cloud services the robot calls out to. The flaws, CVE-2026-76639 and CVE-2026-76640, entered the US National Vulnerability Database on 27 August 2026 with severity scores of 8.8 and 7.5 out of 10. Both give an attacker root — uid 0, the highest level of access on the machine — on G1 EDU firmware up to and including version 1.5.2. Neither needs a password, a pairing code, or any action from the person operating the robot. The first chain starts on TCP port 9991, where the robot runs an unauthenticated bridge between its WebRTC video stack and DDS, the message bus that carries motion commands. The AES-128 key protecting that channel is a fixed value stored so that every account on the device can read it. With the key, an attacker can publish control messages, restart the service that executes shell scripts, and — through a path traversal bug in the upload API of the robot's chat assistant — plant a file of their choosing in the directory that service runs. The second needs only Bluetooth. The G1's BLE server accepts writes without pairing, and the routine that receives a Wi-Fi network name copies it into a fixed-size buffer without checking its length. Overflowing that buffer across several connections corrupts a function pointer sitting next to it, which the cleanup path later invokes — handing attacker-supplied text straight to the system shell as root. What that access reaches is the more uncomfortable part. Olivier Laflamme, the researcher who found both chains, reports pulling off the four robots he tested not only microphones, cameras and motor control, but production credentials for the services the machine depends on: Amazon Polly speech synthesis, iFlytek and Aliyun speech recognition, ByteDance's Doubao, NetEase Music and Alibaba's DashScope, along with access to the object storage holding the robot's data. Those are accounts held by the manufacturer, not by the customer who bought the robot. The disclosure went better than the headline suggests. Laflamme sent the first chain to Unitree on 11 May 2026 and the company confirmed it three days later; the second went over in late June and was confirmed within a week. Patches were written between 1 July and 6 August, and Unitree cleared the write-up for publication on 26 August. Owners running firmware 1.5.2 or older should update. One limit deserves stating plainly: neither flaw works across the open internet. The National Vulnerability Database classes both as adjacent-network attacks — the attacker has to be on the same local network or within Bluetooth range. That is a far smaller blast radius than a remote exploit. It is also a larger one than it sounds, for a machine built to be carried into classrooms, laboratories, trade shows and demonstration halls, where the local network is whatever the venue provides.