CVE-2026-76640: Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack
Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi provisioning script and a buffer overflow in the SSID chunk accumulator. Attackers can send crafted BLE writes to overflow a fixed BSS buffer across BLE connections, corrupting an adjacent mainloop function pointer dispatch entry that is subsequently invoked by the cleanup path passing attacker-controlled data to system() as uid 0.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Unitree G1 EDU devices running firmware through 1.5.2 are exposed when an attacker can communicate with the device over Bluetooth Low Energy at close range. The attack does not require prior pairing or credentials.
What level of access does an attacker need?
An attacker needs only proximate BLE access and the ability to send crafted writes to the GATT server. No authenticated account, paired device, or user interaction is required.
What is the impact after successful exploitation?
Successful exploitation can lead to arbitrary code execution as root (uid 0). This gives the attacker control over the affected device's confidentiality, integrity, and availability.
How does exploitation occur?
The attack chains crafted BLE writes against the WiFi provisioning functionality to overflow the SSID chunk accumulator and corrupt a mainloop function-pointer dispatch entry. A cleanup path subsequently invokes the corrupted entry with attacker-controlled data, reaching system().