Unitree G1 EDU Locomotion PC Exposed to Root RCE via BLE Bootstrap and Path Traversal in chat_go

Researcher Olivier Laflamme demonstrated two independent root-RCE paths on a V1.5.2 G1 EDU. CVE-2026-76639 traverses chat_go to invoke bashrunner with elevated privileges. CVE-2026-76640 begins with an unauthenticated BLE bootstrap that recovers cloud-stored key material due to missing ownership verification, then escalates through a provisioning buffer overflow. Both reach the Locomotion PC controlling movement and sensors. Unitree's July 2026 cloud-side fix blocks the exact key-recovery flow Laflamme tested, yet no firmware release notes or version numbers confirm patches for either CVE. Procurement records and Unitree's EDU model page show the G1 series is marketed for research and light industrial use, where physical actuation and onboard cameras create direct safety and data-exposure risks once root is obtained. Comparable patterns appear in prior Unitree Go1 disclosures and broader humanoid firmware where BLE provisioning and cloud key escrow were left unaudited. The absence of verified remediation timelines leaves deployed units reachable by any attacker within BLE range who can obtain or reuse an account token. Operators should segment these robots from production networks and treat any cloud-bound account as a potential pivot. Independent verification of firmware binaries against Laflamme's primitives remains the only reliable check until Unitree publishes CVE-specific release identifiers.