A critical attack chain could let attackers within Bluetooth range take full control of Unitree G1 humanoid robots, gaining root-level code execution on the locomotion computer that controls movement, cameras, speakers, voice features, and other peripherals.

The flaws could allow a nearby attacker to obtain root-level code execution on the robot’s locomotion computer, which manages major hardware functions, including movement, cameras, speakers, voice features, and other peripherals.

The research, dubbed UniBLEed, describes a multi-stage exploit involving Bluetooth Low Energy, Unitree’s cloud API, Wi-Fi provisioning system, and services running on the robot’s Linux-based control environment.

Hackers Control Unitree G1 Robots

The attack was assigned CVE-2026-76639 and CVE-2026-76640 and was reportedly reproduced on four Unitree G1 robots. The most serious chain begins with a Bluetooth service that accepts writes without requiring Bluetooth pairing.

A nearby device can send a cleartext request to a GATT characteristic identified as 0xFFE2 and receive an encrypted bootstrap package from the robot.

That is the bug that turns Unitree’s legitimate decrypt-and-bind endpoint into a decryption oracle for any nearby robots (source : boschko )

That package includes data needed to recover the robot’s unique AES-128 encryption key. However, the key is initially protected using RSA encryption.

The weakness becomes critical because Unitree’s cloud endpoint, called devicebindExtData, reportedly decrypted this data for any authenticated Unitree account without verifying that the account owned the targeted robot.

An attacker could create or use a free Unitree account, collect the encrypted Bluetooth response and serial number from a nearby G1, submit them to the cloud API, and retrieve the device-specific AES key.

The issue was an authorization failure rather than an authentication failure: the API accepted valid user accounts but did not verify the account-to-robot ownership relationship.

Root RCE via BLE BSS Buffer Overflow in btgatt-server (source : boschko )

Once attackers recovered the AES key, they could complete the G1’s Bluetooth application-level handshake and send Wi-Fi configuration commands. Researchers found that the robot’s Wi-Fi setup script could be manipulated through unsafe handling of Wi-Fi credentials.

By supplying a specially crafted, overlong password, an attacker could force the script into a manual configuration path and inject additional network blocks into the generated wpa_supplicant configuration. This could make the robot join an attacker-controlled Wi-Fi hotspot.

From that network position, the attack chain used another flaw in the G1 Bluetooth server. A Wi-Fi SSID handler copied incoming data into a 500-byte buffer without correctly checking the total amount of data received.

The attacker could send a 1,050-byte payload across one or more Bluetooth connections, corrupting adjacent memory in the server process.

The Boschko research states that the corruption could alter an event-loop cleanup structure and cause the process to invoke a command through system() as root.

A separate root code execution chain, CVE-2026-76639, affected the robot’s ChatGo AI service and BashRunner service.

Root RCE via AI Service chat_go Path Traversal into bashrunner Execution (source : boschko ) — Root RCE via AI Service `chat_go` Path Traversal into `bashrunner` Execution (source : boschko )

Attackers with access to the internal robot network could exploit a path-traversal issue in ChatGPT’s knowledge-upload feature to write files to a directory trusted by BashRunner.

Restarting the service caused BashRunner to execute the attacker-created file as root. The impact is significant because the targeted locomotion computer runs Linux services with root privileges and controls functions critical to a physical robot.

The researchers warned that the Bluetooth chain was potentially wormable: a compromised G1 could theoretically help spread the same exploit to additional vulnerable robots within Bluetooth range.

Unitree reportedly implemented an ownership-binding check for the cloud decryption endpoint in July 2026, before the public disclosure. The researcher said Unitree had patches, including internal fixes, for most or all of the reported issues at the time of publication.

Robot owners should apply the latest vendor firmware and mobile application updates, avoid exposing robots to untrusted nearby Bluetooth devices, and isolate robot management networks from sensitive enterprise systems.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Can Take Full Control of Unitree G1 Humanoid Robots Over Bluetooth appeared first on Cyber Security News.