Description

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, plant a malicious payload in its script execution directory via path traversal, and trigger execution of that payload as uid 0 through the bashrunner shell subprocess.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-27T20:18:38.230Z",
  "pubdate": "2026-08-27T20:18:38.230Z",
  "executiveSummary": "Unitree G1 EDU firmware versions through 1.5.2 are affected by a critical unauthenticated remote code execution (RCE) vulnerability. This vulnerability permits network-adjacent attackers to achieve full administrative control over the robot by chaining three distinct security weaknesses.\nThe attack surface involves an exposed WebRTC-to-DDS bridge, insecure cryptographic key management, and a path traversal flaw within the knowledge upload API. By leveraging these flaws, an attacker can manipulate the internal bashrunner service, inject malicious scripts, and execute them with root privileges (uid 0).\nThis vulnerability poses a severe risk to operational security, as it allows for persistent unauthorized code execution. The exploit does not require authentication, making the device highly susceptible to any actor with network access to the target robot. Successful exploitation leads to total system compromise, potentially allowing for device hijacking, data exfiltration, or the deployment of persistent backdoors.",
  "technicalDetails": "The vulnerability originates from a chained exploitation of three primary security failures in Unitree G1 EDU firmware through 1.5.2. The attack begins by targeting an unauthenticated WebRTC-to-DDS bridge listening on TCP port 9991. This bridge acts as a gateway, allowing network-adjacent attackers to interact with the robot's Data Distribution Service (DDS) middleware without prior authentication.\nThe second component involves the use of a static AES-128 key, which is stored on the filesystem with world-readable permissions. This key is used to protect communication or data integrity, but its static nature and improper access controls allow an attacker to decrypt or forge messages intended for the bridge.\nThe third component is a path traversal vulnerability present in the chat_go knowledge upload API. This API fails to properly sanitize input, allowing an attacker to escape the intended directory and write arbitrary files to the filesystem. The combination of these flaws enables a specific exploit sequence: First, the attacker uses the exposed bridge and known encryption keys to publish malicious DDS control messages. These messages are designed to interact with the bashrunner service. Second, the attacker uses the path traversal vulnerability in the chat_go API to place a malicious payload directly into the script execution directory monitored or utilized by the bashrunner service.\nUpon successful placement of the payload, the attacker sends a command to restart the bashrunner service via the DDS bridge. Because the service executes sub-processes with root privileges (uid 0), the planted script is triggered automatically, resulting in arbitrary code execution with the highest level of system authority. The impact of this chain is total compromise of the robot's host operating system, enabling the attacker to modify system behavior, exfiltrate sensor data, or maintain persistent access. The lack of authentication on the bridge and the API provides an entry point that bypasses standard access control mechanisms, facilitating a reliable and repeatable exploit path for any actor with visibility into the robot's network segment."
}