CyberRota Analysis
AI-GeneratedThe Unitree G1 EDU firmware versions up to 1.5.2 are vulnerable to an unauthenticated remote code execution flaw that allows attackers to execute arbitrary commands with root privileges. This vulnerability arises from a combination of an exposed WebRTC-to-DDS bridge, a static AES-128 key with insecure permissions, and a path traversal issue in the chat_go API. Organizations using this firmware should prioritize patching to mitigate the risk of unauthorized access and potential system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, plant a malicious payload in its script execution directory via path traversal, and trigger execution of that payload as uid 0 through the bashrunner shell subprocess.