CVE-2026-76640
CVE-2026-76640
Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi provisioning script and a buffer overflow in the SSID chunk accumulator. Attackers can send crafted BLE writes to overflow a fixed BSS buffer across BLE connections, corrupting an adjacent mainloop function pointer dispatch entry that is subsequently invoked by the cleanup path passing attacker-controlled data to system() as uid 0.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (26.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 26th percentile — 26.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: -0.000
Weakness classification (CWE)
References
- boschko.ca/g1-ble-rce/ (technical-description, exploit)
- github.com/OlivierLaflamme/UniBLEed (exploit)
- www.vulncheck.com/advisories/unitree-g1-edu-ble-gatt-rce-via-wifi-provisioning-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-76640?
- CVE-2026-76640 is a high-severity vulnerability, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2026-08-27.
- How severe is CVE-2026-76640?
- High severity. CVSS v3 base score is 7.5 out of 10.