CVE-2026-76640: Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack

Vulnerability summary

CVE-2026-76640 is a high (CVSS 7.7) vulnerability in unitree robotics g1 edu. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.9% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 27-08-2026
   PublishedVulnerability first disclosed.
2. 28-08-2026
   Last modifiedVulnerability information updated.

Description

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi provisioning script and a buffer overflow in the SSID chunk accumulator. Attackers can send crafted BLE writes to overflow a fixed BSS buffer across BLE connections, corrupting an adjacent mainloop function pointer dispatch entry that is subsequently invoked by the cleanup path passing attacker-controlled data to system() as uid 0.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.