UniBLEed Wormable Root RCE on the Unitree G1 Through BLE, Cl...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://boschko.ca/g1-ble-rce
• Blog Title: UniBLEed: Wormable Root RCE on the Unitree G1 Through BLE, Cloud Key Decryption, Wi-Fi Injection, and a BSS Overflow
• Suggested Section: Generic Methodologies & Resources > Pentesting Network > DDS/RTPS Security and Service Impersonation, with cross-references under Firmware Analysis, Android Applications Pentesting, File Inclusion/Path Traversal, and Binary Exploitation

🎯 Content Summary

Overview

The post presents UniBLEed, two critical root-RCE chains affecting the Unitree G1 humanoid robot: CVE-2026-76639 and CVE-2026-76640. The first chain combines an exposed DDS/WebRTC control plane, a path traversal in the root-running chat_go AI service, and unsafe execution by bashrunner. The second chains an unauthenticated BLE GATT write, pre-authentication key retrieval, a broken cloud authorization...

🔧 Technical Details

Unauthenticated DDS reconnaissance and service impersonation: DDS embeds participant and endpoint discovery into the protocol. If DDS Security is not enabled, an attacker with network access can join the target domain, enumerate participants, publishers, subscribers, topics, and message types through SPDP/SEDP, passively subscribe to sensitive state streams, and publish messages that appear to originate from trusted internal processes. For RPC layers implemented as request/response topics, reconstruct the message IDL, generate byte-compatible CDR serializers with tools such as CycloneDDS idlc, set the service's function-selecting api_id, and publish directly to rt/api/{service}/request.

WebRTC-to-internal-bus bridge abuse: A WebRTC bridge that converts externally supplied JSON into native middleware messages must independently authorize destination topics and operations. If the JSON controls the DDS topic...

🤖 Agent Actions

Implemented the HackTricks update.

Changes

• Added src/generic-methodologies-and-resources/pentesting-network/dds-rtps-security.md
  • DDS/RTPS discovery and endpoint enumeration
  • Cyclone DDS reconnaissance script and interface configuration
  • IDL/CDR reconstruction and service impersonation
  • WebRTC-to-DDS bridge abuse
  • Related firmware, Android, traversal, ASLR/PIE, and BSS-overflow pivots
  • DDS Security hardening and detection
• Registered the page in src/SUMMARY.md.
• Added cross-references from Firmware Analysis, Android Pentesting, File Inclusion, and PIE pages.
• Added numbered citations using the original research, primary tool repositories, Cyclone DDS documentation, and OMG DDS Security specification.

Validation

• Citation and reference consistency passed.
• All internal cross-reference paths resolve.
• Reference URLs returned HTTP 200.
• No forbidden sources or whitespace errors were introduced.
• mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://boschko.ca/g1-ble-rce

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources > Pentesting Network > DDS/RTPS Security and Service Impersonation, with cross-references under Firmware Analysis, Android Applications Pentesting, File Inclusion/Path Traversal, and Binary Exploitation".

Repository Maintenance:

• MD Files Formatting: 998 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0