TLDR Tech / InfoSec
Unitree G1 Humanoid Robot Flaws Allow Unauthenticated root RCE Over Bluetooth
Two critical flaws have been found in Unitree G1 humanoid robots, potentially leading to unauthenticated root Remote Code Execution (RCE) via Bluetooth. One vulnerability allows an attacker within Bluetooth Low Energy (BLE) range to acquire an AES-128 key without device pairing. The Unitree cloud API improperly decrypts this key, granting access to protected BLE operations, which can be leveraged for a buffer overflow exploit to achieve RCE. The second flaw is a path-traversal vulnerability in the robot's AI service, allowing attackers to upload malicious files to a whitelisted directory for RCE.
Read the full story