CVE-2026-76639: Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal
Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chatgo knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, plant a malicious payload in its script execution directory via path traversal, and trigger execution of that payload as uid 0 through the bashrunner shell subprocess.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Unitree G1 EDU devices running firmware through 1.5.2 are affected when a network-adjacent attacker can reach the WebRTC-to-DDS bridge on TCP port 9991.
Does exploitation require authentication or prior access?
No. The described attack is unauthenticated and requires no privileges or user interaction; the attacker needs network-adjacent access to the affected service.
What level of access can an attacker gain?
By chaining the DDS bridge, exposed static AES-128 key, and knowledge-upload path traversal, an attacker can execute arbitrary commands as root (uid 0).
What can be done if firmware cannot be updated immediately?
Restrict network access to TCP port 9991 so untrusted or network-adjacent systems cannot reach the WebRTC-to-DDS bridge.