Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-08-28 12:07 UTC
Importiert: 2026-09-04 08:57 UTC
CVSS: 8.8
Quelle-ID: thn_global
uid_hash: b050d8e4fad2ed0216842c80dabce4b7d7da0467cc96acef09f1c2be896aa16a

The Hacker News

Inhalt

Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 EDU, including a Bluetooth Low Energy (BLE) path that can reach root on the robot's Locomotion PC.

The flaws are tracked as CVE-2026-76639 and CVE-2026-76640, with the first involving a network-adjacent path through chat_go and bashrunner and the

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-76639	HIGH	8.8	HIGH	8.8			2026-08-27
CVE-2026-76640	HIGH	8.8	HIGH	7.7			2026-08-27

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
The Hacker News	thn_global	security_news		-	de	https://feeds.feedburner.com/TheHackersNews

Zurueck zur Eintrags-Liste