Back to the CVE list
CVE-2026-76640Proof of concept (PoC) published · CISA

Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack

CVSS score

7.7

EPSS probability

%0.3

Risk score

0.0

Published

1 mo ago

OverviewPublic Exploits (1)NewsroomVulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

The Hacker News28.08.2026

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 EDU, including a Bluetooth Low Energy (BLE) path that can reach root on the robot's Locomotion PC. The flaws are tracked as CVE-2026-76639 and CVE-2026-76640, with the first involving a network-adjacent path through chat_go and bashrunner and the

Read the full story

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-76640"