CVE-2026-76640

Published: Ago 27, 2026 Last Modified: Ago 27, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,7
Attack Vector: adjacent
Attack Complexity: high
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH 7,5
Attack Vector: adjacent_network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi provisioning script and a buffer overflow in the SSID chunk accumulator. Attackers can send crafted BLE writes to overflow a fixed BSS buffer across BLE connections, corrupting an adjacent mainloop function pointer dispatch entry that is subsequently invoked by the cleanup path passing attacker-controlled data to system() as uid 0.

306

Missing Authentication for Critical Function

Draft
Common Consequences
Security Scopes Affected:
Access Control Other
Potential Impacts:
Gain Privileges Or Assume Identity Varies By Context
Applicable Platforms
Technologies: Cloud Computing, ICS/OT
View CWE Details
787

Out-of-bounds Write

Draft
Common Consequences
Security Scopes Affected:
Integrity Availability Other
Potential Impacts:
Modify Memory Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Unexpected State
Applicable Platforms
Languages: Memory-Unsafe, C, C++, Assembly
Technologies: ICS/OT
View CWE Details
https://boschko.ca/g1-ble-rce/
https://github.com/OlivierLaflamme/UniBLEed
https://www.vulncheck.com/advisories/unitree-g1-edu-ble-gatt-rce-via-wifi-provi…