CVE-2026-76639 in G1 EDU
Summary
by MITRE • 08/27/2026
Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, plant a malicious payload in its script execution directory via path traversal, and trigger execution of that payload as uid 0 through the bashrunner shell subprocess.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in Unitree G1 EDU firmware versions up to 1.5.2 represents a critical security failure characterized by an unauthenticated remote code execution flaw. This issue stems from a complex chain of three distinct weaknesses that, when exploited sequentially, allow network-adjacent attackers to gain full root-level control over the device. The primary entry point is an improperly secured WebRTC-to-DDS bridge operating on TCP port 9991. This component facilitates communication between real-time media streams and Data Distribution Service protocols but lacks any form of authentication mechanism. Consequently, any actor with network access can interact directly with this interface without providing credentials, establishing the initial foothold required for further exploitation.
The second weakness in this chain involves cryptographic misconfiguration within the DDS subsystem. The system relies on a static AES-128 encryption key that is stored with world-readable file permissions. This design choice severely undermines the confidentiality and integrity of communications protected by this key. Since the key is publicly accessible, attackers can decrypt existing traffic or craft valid encrypted messages to impersonate legitimate services within the DDS ecosystem. The use of a static key further exacerbates this risk, as it remains constant across devices and over time, allowing for persistent decryption capabilities without the need for dynamic key exchange protocols that would mitigate such exposure.
The final component in the attack chain is a path traversal vulnerability located within the chat_go knowledge upload API. This flaw allows an attacker to manipulate file paths during the upload process, enabling them to write files outside of the intended directory structure. By combining this capability with the ability to publish DDS control messages via the unauthenticated bridge and decrypting or forging necessary authentication tokens using the exposed static key, attackers can execute a precise sequence of actions. They first use the DDS interface to restart the bashrunner service, which is responsible for executing shell scripts on the device. Subsequently, they utilize the path traversal flaw to plant a malicious payload in the specific directory where the bashrunner script execution occurs.
Once the malicious payload is placed in the correct location and the bashrunner service is restarted through the DDS control message, the system automatically executes the planted file with root privileges (uid 0). This results in arbitrary code execution at the highest level of privilege on the device. The operational impact of this vulnerability is severe, as it grants attackers complete administrative access to the Unitree G1 EDU robot. This can lead to unauthorized control of robotic movements, theft of sensitive data processed or stored by the device, and potential use of the compromised unit as a pivot point for further attacks within the local network infrastructure.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, specifically regarding the lack of access controls on the WebRTC-to-DDS bridge. The static key exposure corresponds to CWE-321 Use of Hard-coded Cryptographic Key and CWE-732 Incorrect Permission Assignment for Critical Resource due to world-readable file permissions. The path traversal element is categorized under CWE-22 Improper Limitation of a Pathname to a Restricted Directory, while the resulting remote code execution falls under CWE-94 Improper Control of Generation of Code or Script. In terms of tactical mapping within the MITRE ATT&CK framework, this exploit leverages Initial Access through unauthenticated API endpoints and Privilege Escalation via improper permission settings and service manipulation to achieve full system compromise.
Mitigation strategies must address all three components of this vulnerability chain simultaneously. The most effective immediate remediation is to apply the firmware update provided by Unitree that patches these issues in versions later than 1.5.2. For systems where updates are not immediately feasible, network segmentation should be implemented to restrict access to TCP port 9991 from untrusted networks. Additionally, administrators must ensure that sensitive configuration files containing cryptographic keys have restrictive file permissions, such as read-only for the root user only. Implementing mutual TLS authentication for DDS communications and validating all input paths in the chat_go API against directory traversal patterns are also critical defensive measures to prevent exploitation of these specific weaknesses until a permanent patch is deployed.