Loading story…
Researchers disclosed UniBLEed, two critical attack chains that can grant root-level remote code execution on Unitree G1 humanoid robots. CVE-2026-76639 affects G1 EDU firmware through version 1.5.2: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a world-readable AES-128 key, and path traversal in the chat_go knowledge-upload API allow an attacker to restart the bashrunner service, place a malicious script in its execution path, and have it run as root on the locomotion PC.
CVE-2026-76640 reportedly permits an attacker within Bluetooth Low Energy range to write to an unpaired BLE characteristic, recover the robot's AES-128 key through an improperly authorized Unitree cloud decryption endpoint, alter Wi-Fi settings, and exploit a buffer overflow in btgatt-server for root command execution. The BLE route may be wormable, allowing a compromised robot to target nearby G1 units. Unitree validated the findings, added an account-to-robot ownership binding check to the cloud key-recovery process in July 2026, and said patches were available or under development for the reported issues.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
The CVE-2026-76639 record for unauthenticated root RCE in Unitree G1 EDU firmware through version 1.5.2 was received by disclosure@vulncheck.com.
Unitree paid a total $5,000 bounty: $1,000 for the chat_go RCE and $4,000 for the BLE RCE.
Unitree reportedly validated the CVE-2026-76640 chain, which combines unauthorized BLE access, cloud key recovery, Wi-Fi provisioning abuse, and a btgatt-server overflow to obtain root execution.
Unitree reportedly validated the CVE-2026-76639 chat_go and bashrunner root-RCE chain affecting Unitree G1 robots.
Unitree implemented an ownership-binding check for its cloud key-recovery endpoint, preventing authenticated accounts from decrypting bootstrap material for robots they did not own.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcecvefeed.io
Open sourceboschko.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple critical vulnerabilities in **Ubiquiti UniFi OS** can be chained to give an unauthenticated attacker **remote code execution as root** on exposed devices. Fortinet reported active in-the-wild exploitation of an exploit chain involving `CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`, combining authentication bypass, path traversal, access to protected resources, and arbitrary command execution. Researchers have publicly demonstrated the chain, raising the risk for organizations that use UniFi OS to manage gateways, network controllers, video surveillance, and access control systems. `CVE-2026-34909` is described as a **CVSS 10.0** path traversal flaw that can expose sensitive files and enable account compromise, while `CVE-2026-34910` is a **CVSS 10.0** command injection bug affecting a wide range of UniFi hardware and the software-only **UniFi OS Server**. Ubiquiti addressed the issues in **Security Advisory Bulletin 064** with firmware updates across product families, including **UniFi OS 5.1.12** for many devices and other fixed releases for NAS, UDM Beast, and UniFi OS Server platforms. Defenders are being urged to patch immediately, limit management interfaces to trusted networks, review internet-exposed systems for compromise, and perform integrity checks because persistence may remain after remediation.
Aug 15, 2026
Researchers at **Bishop Fox** confirmed that multiple flaws in **Ubiquiti UniFi OS Server** can be chained into **unauthenticated remote code execution** that yields full **root** access on exposed systems. The attack combines an authentication bypass and path traversal in the Nginx/`unifi-core` request flow—tracked as `CVE-2026-34908` and `CVE-2026-34909`—with a command injection bug in the `package-update` service, `CVE-2026-34910`, and can be triggered through a reachable web request against internet-facing management interfaces. Researchers said the chain was validated end-to-end and can also leverage overly permissive sudo rights to complete privilege escalation. Successful exploitation can expose stored secrets, enable forged administrative sessions that may persist after patching, and create downstream risk for managed network gear, door-access systems, and surveillance cameras connected through the platform. Ubiquiti said fixes were released in patched UniFi OS Server versions, including protections such as URI normalization, stricter package-name validation, removal of shell-based backend behavior, and reduced passwordless sudo permissions. Defenders are being urged to patch immediately, rotate credentials and secrets, review systems for signs of prior compromise, and limit or remove public exposure of UniFi management interfaces.
Jun 29, 2026
Two critical vulnerabilities have been discovered in Red Lion Sixnet remote terminal units (RTUs), which are widely deployed in industrial control systems across sectors such as energy, water and wastewater treatment, transportation, utilities, and manufacturing. The vulnerabilities, identified as CVE-2023-42770 and CVE-2023-40151, both carry the maximum CVSS score of 10.0, indicating their severity and potential for exploitation. CVE-2023-42770 is an authentication bypass flaw that arises because the affected RTUs only enforce authentication on UDP port 1594, while the same port over TCP does not require authentication, allowing attackers to send unauthorized commands. CVE-2023-40151 is a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary Linux shell commands as root via the Sixnet Universal protocol. These vulnerabilities can be chained, enabling a remote attacker to bypass all authentication and gain full control over the RTU, potentially leading to significant disruptions in critical infrastructure operations. The flaws were discovered by Claroty’s Team82, who withheld full exploit details to give organizations time to patch their systems. Red Lion’s Sixnet IO Tool Kit, a Windows-based utility, is used to configure these RTUs and communicates using a proprietary protocol that was found to be susceptible to these attacks. The vulnerabilities affect both the SixTRAK and VersaTRAK series of RTUs. The user-permission system implemented in the protocol was intended to restrict access, but the lack of authentication checks on TCP traffic undermines this security measure. Security experts have warned that exploitation of these vulnerabilities could allow attackers to manipulate, disrupt, or destroy industrial processes controlled by the compromised RTUs. The affected devices are integral to automation, control, and data acquisition in industrial environments, making the risk of exploitation particularly concerning. Organizations using these RTUs are urged to apply available patches and review network segmentation to limit exposure. The vulnerabilities highlight the ongoing risks associated with legacy industrial protocols and the importance of rigorous security testing in critical infrastructure environments. Claroty’s report provides technical details on the flaws and emphasizes the need for immediate remediation. The disclosure underscores the potential for unauthenticated remote attacks to have far-reaching impacts on essential services. Security professionals recommend monitoring for unusual network activity on port 1594 and implementing strict access controls. The incident serves as a reminder of the critical need for robust authentication and secure protocol design in industrial control systems.
Jul 12, 2026