Description

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi provisioning script and a buffer overflow in the SSID chunk accumulator. Attackers can send crafted BLE writes to overflow a fixed BSS buffer across BLE connections, corrupting an adjacent mainloop function pointer dispatch entry that is subsequently invoked by the cleanup path passing attacker-controlled data to system() as uid 0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T20:18:38.380Z",
  "pubdate": "2026-08-27T20:18:38.380Z",
  "executiveSummary": "Unitree G1 EDU firmware versions through 1.5.2 contain critical vulnerabilities within the BLE GATT server and WiFi provisioning stack. These flaws enable unauthenticated, proximate attackers to achieve remote code execution (RCE) with root privileges.\nThe vulnerability chain leverages a buffer overflow in the SSID chunk accumulator and an unquoted heredoc variable within the WiFi provisioning script. By transmitting crafted BLE writes, an attacker can corrupt memory, specifically targeting a function pointer in the mainloop that governs the cleanup path.\nBecause the system executes these operations with UID 0 (root), successful exploitation grants complete control over the robot. This attack requires no prior pairing, credentials, or user interaction, relying solely on proximity to the device's BLE interface. The impact includes full system compromise, potential persistent access, and unauthorized control over robot functions, posing significant security risks to the integrity and safety of the Unitree G1 platform.",
  "technicalDetails": "The vulnerability originates from two primary weaknesses in the Unitree G1 BLE provisioning service: an unsafe buffer management implementation and insecure command construction during WiFi configuration.\nThe initial stage of the attack involves a buffer overflow in the SSID chunk accumulator. The BLE GATT server fails to properly sanitize or validate the length of incoming SSID data fragments. An attacker can send a series of crafted BLE writes that exceed the capacity of the fixed BSS buffer. Due to the proximity of the buffer to critical control structures in memory, this overflow allows the attacker to overwrite an adjacent mainloop function pointer dispatch entry.\nThe exploitation flow proceeds as follows: 1) The attacker connects to the BLE GATT server without authentication. 2) The attacker transmits specifically crafted packets that trigger the overflow of the SSID accumulator buffer. 3) The memory corruption target is a function pointer used within the mainloop's cleanup routine. 4) By controlling the value of this pointer, the attacker redirects the execution flow to a payload of their choosing upon the invocation of the cleanup path.\nThe secondary stage of the exploit utilizes an unquoted heredoc variable in the WiFi provisioning script. When the corrupted mainloop cleanup path triggers the execution of this script, it passes attacker-controlled data into a system() call. Because the provisioning script is executed with root privileges (UID 0), the injected commands are executed directly by the operating system as root.\nThis vulnerability is particularly dangerous because it bypasses standard authentication and pairing mechanisms entirely. The exploit persists as long as the device has the vulnerable BLE interface enabled, allowing for silent, unauthenticated command injection. The impact is a full system compromise, providing the attacker with persistent root access to the underlying Linux environment of the Unitree G1 EDU.\nThe vulnerable component is the BLE GATT server and the associated WiFi provisioning stack script in firmware versions 1.5.2 and earlier. The lack of bounds checking in the SSID processing logic and the insecure handling of variables in the shell script represent the core technical failures."
}