Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Unitree G1 EDU BLE provisioning root RCE (CVE-2026-76640)

Vulnerability
First reported
Last updated
Happening score
H score 28
1 unique sources, 1 articles

Summary

Hide ▲

Unitree G1 EDU owners face a disclosed CVE-2026-76640 chain that can turn BLE proximity into root code execution on the Locomotion PC. The initial BLE write path accepts the bootstrap interaction without Bluetooth pairing, while later Wi‑Fi provisioning operations depend on the application's authenticated BLE state. Researchers tied the chain to a buffer overflow in provisioning and said no confirmed fixed firmware release was verified in accessible guidance. The cloud-account ownership check used in the proof-of-concept was patched in July 2026, but that does not provide a verified firmware remediation target for the vulnerability itself.

Related Happenings

CISA adds CVE-2026-20262 to KEV and orders federal fixes

Public Sector Action
H score32 First: 16.06.2026 09:05 Last: 16.06.2026 09:05 Sources 1

About this happening: CISA added CVE-2026-20262 to its Known Exploited Vulnerabilities (KEV) catalog and required Federal Civilian Executive Branch (FCEB) agencies to apply Cisco's fixe...

Open Happening

Timeline

  1. 28.08.2026 15:07 2 articles · 2h ago

    Olivier Laflamme discloses BLE provisioning root RCE in the Unitree G1 EDU

    Initial Disclosure

    Security researcher Olivier Laflamme disclosed CVE-2026-76640 as a root-RCE chain affecting the Unitree G1 EDU, where a BLE proximity path accepts the bootstrap interaction without Bluetooth pairing and later Wi-Fi provisioning requires the application's authenticated BLE state. Laflamme said the chain reaches a buffer overflow in provisioning and can produce root execution on the robot's Locomotion PC, while accessible Unitree guidance did not verify a fixed firmware release for the issue.

    Show sources
    Open in new tab