VulnSocial

CVE-2026-76639Disclosure

HIGHCVSS 8.7 · HIGH

Exploitation observed; activity peaked at 4 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, plant a malicious payload in its script execution directory via path traversal, and trigger execution of that payload as uid 0 through the bashrunner shell subprocess.

Back to dashboard
7.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22CWE-306

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 6 mentions across 3 observed days

What's happening

  • Active exploitation reported across 1 signal
  • Exploit tool or code specified in 2 signals
  • PoC mentioned or linked in 4 signals
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 6 signals
  • Disclosure: 3 classified signals
  • Peaked 2d ago at 4 mentions (2026-08-28); latest day: 1
  • 6 total mentions across 3 days

Deep dive

Activity timeline6 mentions / 3d
01234Mentions · 2026-08-28: 4Mentions · 2026-08-31: 1Mentions · 2026-09-01: 1PoC Mentioned / Linked · 2026-08-28: 2PoC Mentioned / Linked · 2026-08-31: 1PoC Mentioned / Linked · 2026-09-01: 1Exploit Tool / Code · 2026-08-31: 1Exploit Tool / Code · 2026-09-01: 1Active Exploitation · 2026-08-31: 1Patch / Workaround · 2026-08-28: 2Technical Details · 2026-08-28: 4Technical Details · 2026-08-31: 1Technical Details · 2026-09-01: 108-2808-3109-01
Signal classification4 categories
Disclosure
350.0%
PoC
116.7%
Active Exploitation
116.7%
Exploit
116.7%
Referenced assets46 URLs
By indicator
Classification over time
DateTotalLabels
2026-08-284
Disclosure3PoC1
2026-08-311
Active Exploitation1
2026-09-011
Exploit1
Full discourse6 posts
  • Mr.Niko@_MrNiko
    Exploit

    🚨 root on a $20k Unitree G1 from Bluetooth range wormable BLE chain. no pairing needed. AES key leak → WiFi hijack → chatbot path traversal → BSS overflow → system() as root $6.7k bounty. CVE-2026-76639 / 76640 https://boschko.ca/g1-ble-rce/ #VulnerabilityResearch #ExploitDev #InfoSec

    Post summary

    The tweet shares a PoC of a wormable BLE RCE chain for the Unitree G1 robot, detailing the exploit steps and earning a $6.7k bounty, but no active exploitation or patch has been reported.

    01033332
    1.5K followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🚨 Unitree G1 EDU insansı robotta iki ayrı root RCE zinciri ortaya çıktı! CVE-2026-76639 olarak numaralandırılan açık, chat_go içindeki path traversal açığını bashrunner üzerinden kullanarak Locomotion PC'de root code execution elde edilmesine yol açıyor. CVE-2026-76640 ise Bluetooth Low Energy (BLE) üzerinden başlayıp Wi-Fi provisioning kodundaki bir buffer overflow ile yine root RCE'ye ulaşabiliyor. Araştırmacı ayrıca Unitree cloud servisindeki bir yetkilendirme açığı üzerinden başka bir G1 EDU'ya ait anahtar materyalinin alınabildiğini gösterdi. Bu cloud tarafındaki sorun Temmuz 2026'da düzeltildi.

    Post summary

    Unitree G1 EDU robot disclosed two root RCE chains—one via path traversal in chat_go and one via BLE buffer overflow; a cloud‑side authorization flaw was also noted and subsequently fixed.

    00030474
    2.4K followersView on X
  • Security Arsenal, LLC@SecurityAr58409
    Disclosure

    🔒 #CyberSecurity CVE-2026-76639 & CVE-2026-76640: Unitree G1 EDU Humanoid Root RCE — Detection a… "Security researcher Olivier Laflamme has publicly disclosed two independent, unauthenticated…" 🔗 https://securityarsenal.com/blog/cve-2026-76639-and-cve-2026-76640-unitree-g1-edu-humanoid-root-rce-detection-and-remediation-guide #CyberSecurity #ThreatIntel #critical #zeroday #cve

    Post summary

    A security researcher has publicly disclosed two CVE-2026-76639 and CVE-2026-76640 root RCE vulnerabilities affecting the Unitree G1 EDU Humanoid; the blog post offers detection and remediation guidance but does not include PoC, exploit code, or patch details.

    0001161
    29 followersView on X
  • Machina Record@MachinaRecord
    Active Exploitation

    【リンク集：週末のセキュリティ関連ニュース/記事】 ＜脆弱性＞ ・PaperCut NG／MFのゼロデイ脆弱性が悪用される　全バージョンに影響 https://thehackernews.com/2026/08/papercut-zero-day-exploited-in-attacks.html ・cPanelに重大な欠陥　ホスティングアカウントからサーバー全体のroot権限を取得できる恐れ（CVE-2026-65643） https://thehackernews.com/2026/08/critical-cpanel-flaw-could-let-one.html ・ServiceNow、最大深刻度のセキュリティ脆弱性3件について警告（CVE-2026-18885、CVE-2026-18886他） https://www.bleepingcomputer.com/news/security/servicenow-warns-of-three-max-severity-security-vulnerabilities/ ・攻撃で悪用されている欠陥の大半は数十年来のもの　米CISAの調査で明らかに https://www.theregister.com/security/2026/08/28/cisa-most-exploited-vulnerabilities-should-have-been-eradicated-decades-ago/5293194 ・ヒューマノイドロボットUnitree G1 EDUにroot権限でのRCEを可能にする脆弱性が2件見つかる　Bluetooth経由で始まるものも（CVE-2026-76639、CVE-2026-76640） https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html ・Giteaサーバー8,300台超がいまだパッチ未適用　コード実行攻撃に脆弱（CVE-2026-60004） https://www.bleepingcomputer.com/news/security/over-8-300-gitea-servers-vulnerable-to-code-execution-attacks/ ・米CISAがownCloud・Linuxカーネル・JFrog Artifactoryの脆弱性をKEVカタログに追加（CVE-2023-49105、CVE-2026-53362他） https://securityaffairs.com/198014/hacking/u-s-cisa-adds-owncloud-linux-kernel-and-jfrog-artifactory-flaws-to-its-known-exploited-vulnerabilities-catalog.html ・寄付プラグインGiveWPの欠陥により、ホスティングサーバー上で任意のコマンド実行が可能に（CVE-2026-82222） https://www.bleepingcomputer.com/news/security/givewp-wordpress-donation-plugin-flaw-lets-hackers-execute-server-commands/ ・Cosmos EVMの欠陥が悪用される　Cosmos Labsはブロックチェーンの脆弱性を事前に正しく評価できず https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html ・Kaspersky Antivirus for Endpointにおける権限昇格のゼロデイ「HardBreacher」を、Nightmare Eclipseが公開 https://github.com/MSNightmare/HardBreacher ・Nvidia GreenSectionにおけるメモリ破損のゼロデイ脆弱性「GreenSection」を、Nightmare Eclipseが公開 https://github.com/MSNightmare/GreenSection ・居住者のログイン1回で集合住宅全体へアクセス可能に　RentlyのAPIにおけるマスターPINの脆弱性（CVE-2026-75960） https://planckdefense.com/blog/rently-master-pin-idor-cve-2026-75960 ・ownCloudの脆弱性が悪用され、フィリピンの原子力研究機関から核関連レコードが盗まれる（CVE-2023-49105） https://thehackernews.com/2026/08/snowflake-github-actions-flaw-lets.html ・中国ZBT製ルーターにインプラント2件が存在　未認証の攻撃者にrootアクセス権を付与（CVE-2026-74232、CVE-2026-74233） https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html ＜マルウェア・その他脅威＞ ・暗号通貨ウォレットのシードフレーズを収集するChromeとEdgeの拡張機能が19件発見される https://cyberinsider.com/19-chrome-and-edge-extensions-caught-harvesting-crypto-wallet-seeds/ ・TerminalFixがリバーストンネル型バックドアを展開、偽のCloudflare CAPTCHAを使用 https://thehackernews.com/2026/08/terminalfix-uses-fake-cloudflare.html ・アンソロピック、インフォスティーラーによるClaudeセッション乗っ取りと利用枠の不正消費を警告https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/ ＜ランサムウェア＞ ・米アルコール・たばこ・火器爆発物取締局がサイバーインシデントを確認　Qilinグループによる犯行声明受け https://www.securityweek.com/atf-confirms-cyber-incident-after-ransomware-group-claims-attack/ ・ベルリン州政府、同市行政ネットワークからデータ盗んだハッカーへの身代金支払いを拒否 https://thehackernews.com/2026/08/berlin-refuses-to-pay-hackers-who-stole.html ＜データ侵害/サイバー犯罪＞ ・英マンチェスター空港グループで侵害発生　顧客データ約870万人分が盗まれる https://www.helpnetsecurity.com/2026/08/28/manchester-airports-group-data-breach/ ・米医療系大手McKessonがデータ侵害を公表　ShinyHuntersの主張受け https://www.bleepingcomputer.com/news/security/mckesson-discloses-breach-after-shinyhunters-claims-patient-data-theft/ ・英EVリース企業Love Electricの運転記録87万7,000件が流出、600米ドルで販売される https://securityaffairs.com/198033/data-breach/love-electric-breach-877000-driver-records-offered-for-600.html ・FulcrumSec、マンチェスター空港へのハッキングと86GBのデータ窃取を主張 https://www.bleepingcomputer.com/news/security/fulcrumsec-claims-manchester-airports-hack-theft-of-86-gb-of-data/ ・玩具大手ハズブロがデータ侵害を公表　従業員に影響及ぶ https://www.bleepingcomputer.com/news/security/toy-making-giant-hasbro-disclose-data-breach-affecting-employees/ ＜AI関連＞ ・テック・サイバーセキュリティ大手企業群、OpenAI主導のサイバー防御策に関する共同声明に署名 https://www.securityweek.com/tech-cybersecurity-giants-unite-behind-openai-led-cyber-defense-pledge/ ・中国製AIを排除するにはモデルの系統を見よ　シスコが助言 https://www.securityweek.com/think-youve-eliminated-chinese-ai-check-the-models-lineage-cisco-says/ ・Claude・Codex・Hermesなど主要AIツールが企業ネットワーク内に不審なコードをインストールする可能性 https://www.techradar.com/pro/security/top-ai-tools-including-claude-codex-and-hermes-installed-suspicious-code-inside-corporate-networks ・米国防総省が不当にアンソロピック社をブラックリストに追加　Claudeの持つ権限めぐり https://www.theregister.com/ai-and-ml/2026/08/28/pentagon-blacklisted-anthropic-over-claude-powers-it-didnt-have/5293266 ＜サイバー戦/APT/国家型アクター/地政学関連＞ ・APT28関連のHOOKEDGEバックドアが欧州の政府・外交機関を標的に https://thehackernews.com/2026/08/apt28-linked-hookedge-backdoor-targets.html ・北朝鮮のリモートワーカー、IT分野以外にも職探しの幅を広げる https://www.helpnetsecurity.com/2026/08/28/north-korean-remote-workers-jobs-sales-and-marketing/ ・影響工作への関与疑われる中国のボットアカウント約20万件がXで見つかる https://ministryofcyberaffairs.com/news/suspected-chinese-bot-farm-of-approx-200-000-accounts-involved-in-influence-operations-idenfied-by-x-2ff79ffb-2686-40c7-8b2e-69fcad94ce6b ＜逮捕/テイクダウン/制裁/違反/その他法執行関連＞ ・アンソロピック社、サプライチェーンリスクとみなされた訴訟で米国防総省に初の勝訴 https://techcrunch.com/2026/08/28/anthropic-gets-its-first-court-win-over-the-pentagons-supply-chain-risk-label/ ・違法なIPTVサービスを提供した68歳の男に実刑判決　約98万英ポンド130万米ドルの収益上げる https://www.bleepingcomputer.com/news/security/68-year-old-imprisoned-after-making-13-million-by-pirating-iptv-services/ ・元米国防情報局のIT専門家、機密情報漏洩未遂の罪を認める https://www.scworld.com/brief/former-dia-it-specialist-pleads-guilty-to-attempting-to-leak-classified-information ・ソニーミュージックとワーナーがアンソロピックを提訴　「厚顔無恥な」知的財産侵害行為と主張 https://techcrunch.com/2026/08/29/sony-music-warner-sue-anthropic-alleging-a-brazen-campaign-of-intellectual-property-theft/ ＜プライバシー＞ ・Android 17で新たな保護機能を追加　不正なWi-FiトラッキングやWebスヌーピングに対応 https://www.helpnetsecurity.com/2026/08/28/android-17-network-security-features/ ・米市郡でFlock Safety製監視カメラの契約解除が続出　 8月だけで90自治体が解約 https://arstechnica.com/tech-policy/2026/08/cities-terminate-flock-contracts-at-record-pace-in-august/ ＜リサーチ/攻撃手法/TTP＞ ・TeamCityにおける認証不要のRCE脆弱性について解説（CVE-2026-63077） https://blog.securelayer7.net/cve-2026-63077-teamcity-rce/ ・Cl0pが認証情報なしで企業情報にアクセスした方法 https://www.scworld.com/perspective/how-clop-accessed-the-enterprise-blueprint-with-no-credentials ・Claude CodeにWebサイト要約を依頼するだけで有害コードの実行が可能に　研究者が方法を紹介 https://www.theregister.com/research/2026/08/28/researcher-shows-how-claude-code-can-be-tricked-simply-by-asking-it-to-summarize-a-website/5293372 ・ブロックチェーンのスキミング：マルバタイズスキャン中にEtherHidingを使うMagecartキャンペーンが発見される https://blog.confiant.com/p/skimming-on-the-blockchain-a-magecart ・100社に個人データの開示を要求した結果、数社は勝手にデータを削除 https://arstechnica.com/tech-policy/2026/08/i-asked-100-companies-for-my-data-some-deleted-it-instead/ ・悪用追跡：ADCSデータベースを通じた権限昇格の検知 https://www.guidepointsecurity.com/blog/detecting-privilege-escalaction-through-adcs/ ・Chromeウェブストアの拡張機能で暗号資産やブラウザデータを窃取 https://www.bleepingcomputer.com/news/security/chrome-web-store-extensions-caught-stealing-crypto-browser-data/ ＜その他＞ ・アンソロピック、Claude Codeの週次利用制限枠を17％縮小へ ・

    Post summary

    The text discusses multiple CVEs actively exploited in the wild, including zero-days and those added to CISA's KEV catalog. PoC code repositories are linked for some vulnerabilities, and technical details (severity, attack vectors) are provided for several, but no patches or workarounds are explicitly mentioned.

    000012.3K
    1.3K followersView on X
  • Ⓓ Ⓒ Ⓝ ㋡ ≡ ∀ ≡@DCNChannel
    PoC

    Исследователь безопасности Оливье Лафламм в среду опубликовал два эксплойта, обеспечивающих удалённое выполнение кода с правами root и затрагивающих гуманоидного робота Unitree G1 EDU; уязвимостям присвоены идентификаторы CVE-2026-76639 и CVE-2026-76640.

    Post summary

    Security researcher Olivier Laflamme published two remote code‑execution exploits for the Unitree G1 EDU humanoid robot (CVE‑2026‑76639/76640) that allow root‑level access.

    1000032
    547 followersView on X
  • yousukezan@yousukezan
    Disclosure

    Unitree G1 EDUに、ロボットのLocomotion PC上でroot権限のコード実行につながる2件の脆弱性「CVE-2026-76639」「CVE-2026-76640」が見つかった。Olivier Laflammeが8月27日に技術詳細を公開した。 CVE-2026-76639はchat_goのパストラバーサルを悪用してbashrunnerへ到達し、Locomotion PC上でrootコード実行につなげる。CVE-2026-76640はBLE近接通信から始まり、bootstrap処理はBluetoothペアリングなしで書き込みを受け付ける。研究時点ではUnitreeのクラウドが、キー復旧要求を行ったアカウントと指定ロボットの所有関係を確認せず、別のG1 EDUの鍵情報を取得できたという。取得した鍵で認証済みBLE状態を確立後、Wi-Fiプロビジョニング処理のバッファオーバーフローを悪用してroot権限を得た。 Unitreeは2026年7月にクラウドの所有確認を修正し、この実証経路は成立しなくなった。記事執筆時点では、修正済みと確認できるファームウェア版は示されていない。 https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html

    Post summary

    Two CVEs in the Unitree G1 EDU robot allow root execution via path traversal and BLE exploits; technical details were publicly disclosed, and a patch was released though no firmware version is confirmed yet.

    000101.4K
    14.9K followersView on X

Explore more

Back to dashboard