UNITREE G1 HUMANOID ROBOT FLAWS ALLOW UNAUTHENTICATED ROOT RCE OVER BLUETOOTH

Summary from the TLDR InfoSec newsletter

A security researcher discovered two independent flaws in Unitree G1 humanoid robots that could enable RCE on the devices. The first vulnerability allows an attacker within BLE range to obtain an AES-128 key without requiring the device to pair. The researcher found that the Unitree cloud API would decrypt the key without verifying ownership or serial numbers, allowing the researcher to access protected BLE operations, eventually allowing the attacker to exploit a buffer overflow to achieve RCE. The second path involves a path-traversal vulnerability in the robot's AI service, which enables an attacker to upload a file to the bashrunner's whitelist directory, enabling RCE.