CVE-2026-76639 & CVE-2026-76640: Unitree G1 EDU Humanoid Root RCE — Detection and Remediation Guide

---
title: Unitree G1 bashrunner Service Spawning Shell Commands
id: 3f8c1a72-6b2e-4d91-ac47-9e0f5d2b8a11
status: experimental
description: Detects the bashrunner or chat_go services on Unitree G1 EDU robots spawning shell interpreters or execution utilities, consistent with exploitation of CVE-2026-76639.
references:
  - https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.execution
  - attack.t1059.004
  - cve.2026.76639
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'bashrunner'
      - 'chat_go'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor firmware updates invoking scripts through control services (correlate with maintenance windows)
level: high
---
title: Suspicious Persistence or Download Activity on Robot Compute
id: 8b2d4e61-1c7a-4f35-b908-2e6a3d9f0c55
status: experimental
description: Detects creation of systemd units, cron entries, or outbound download tooling execution on Unitree robot compute, consistent with post-exploitation persistence following CVE-2026-76639 or CVE-2026-76640 compromise.
references:
  - https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.persistence
  - attack.t1053.003
  - attack.t1543.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_cron:
    CommandLine|contains:
      - '/etc/cron'
      - 'crontab '
      - '/var/spool/cron'
  selection_systemd:
    CommandLine|contains:
      - 'systemctl enable'
      - 'systemctl start'
      - '/etc/systemd/system/'
  selection_download:
    CommandLine|contains:
      - 'curl http'
      - 'wget http'
      - 'base64 -d'
      - '/dev/tcp/'
  condition: 1 of selection_*
falsepositives:
  - Legitimate robot software installation or OTA update activity
level: high
---
title: Interactive Shell From Non-Standard Parent on Robot Compute
id: c51e9a08-4f6b-48d2-bb71-0a3c7f5e2d94
status: experimental
description: Detects interactive shells spawned by unexpected parent processes on robot Linux compute, indicating successful remote exploitation rather than legitimate SSH administrative access.
references:
  - https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_shell:
    Image|endswith:
      - '/bash'
      - '/sh'
  filter_legit:
    ParentImage|endswith:
      - '/sshd'
      - '/login'
      - '/systemd'
  condition: selection_shell and not filter_legit
falsepositives:
  - Vendor agent or OTA tooling spawning shells (baseline and allowlist per robot image)
level: medium

let Lookback = 14d;
Syslog
| where TimeGenerated > ago(Lookback)
| where Computer has_any ("g1", "unitree", "locomotion")  // tune to your robot hostnames
| where SyslogMessage has_any ("bashrunner", "chat_go")
   or (SyslogMessage has_any ("cron", "systemctl enable", "curl http", "wget http", "/dev/tcp/", "base64 -d"))
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc;
// Correlate with unexpected inbound connections to robot services
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DestinationHostName has_any ("g1", "unitree") or DestinationIP in (dynamic([]))  // populate robot IP ranges
| where DestinationPort !in (22, 443, 53)  // flag non-standard service ports
| summarize ConnectionCount = count(), DistinctSources = dcount(SourceIP) by DestinationIP, DestinationPort, bin(TimeGenerated, 1h)
| where ConnectionCount > 50 or DistinctSources > 3
| order by TimeGenerated desc

-- Hunt for suspicious processes and persistence on Unitree robot compute
LET suspicious_procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'bashrunner|chat_go'
   OR (Name =~ 'bash|sh$' AND Username =~ 'root' AND CommandLine =~ 'curl|wget|nc |/dev/tcp/')

LET persistence = SELECT FullPath, Mtime, Size
FROM glob(globs=['/etc/systemd/system/*.service', '/etc/cron.d/*', '/var/spool/cron/crontabs/*', '/root/.ssh/authorized_keys'])
WHERE Mtime > now() - 1209600  -- modified in last 14 days

LET listeners = SELECT Pid, Name, LocalAddress, LocalPort, RemoteAddress, Status
FROM netstat()
WHERE Status =~ 'LISTEN' AND LocalPort NOT IN (22, 5353, 1900)

SELECT * FROM suspicious_procs
UNION ALL SELECT Pid=NULL, Ppid=NULL, Name='PERSISTENCE', CommandLine=FullPath, Exe=NULL, Username=NULL, CreateTime=Mtime FROM persistence

#!/bin/bash
# Unitree G1 EDU interim hardening — CVE-2026-76639 / CVE-2026-76640
# Run as root on the Locomotion PC. Test in a lab robot first.

# 1. Check for vendor firmware update availability
echo "[*] Current firmware/software versions:"
dpkg -l 2>/dev/null | grep -i -E 'unitree|chat_go|bashrunner' || \
  ls -la /opt/unitree/ /home/unitree/ 2>/dev/null

# 2. Disable BLE when not actively required (WORKAROUND — breaks app pairing)
echo "[*] Disabling Bluetooth to close the CVE-2026-76640 BLE attack path..."
systemctl stop bluetooth 2>/dev/null
systemctl disable bluetooth 2>/dev/null
rfkill block bluetooth 2>/dev/null
hciconfig hci0 down 2>/dev/null

# 3. Restrict network-adjacent services to management VLAN only
echo "[*] Applying host firewall rules — allow SSH from mgmt subnet only..."
MGMT_NET="10.10.20.0/24"   # <-- CHANGE to your management/robotics subnet
iptables -F INPUT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s "$MGMT_NET" -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP
iptables-save > /etc/iptables/rules.v4 2>/dev/null || iptables-save > /etc/iptables.rules

# 4. Audit persistence and unexpected listeners
echo "[*] Persistence audit:"
crontab -l 2>/dev/null; ls -la /etc/cron.d/ /etc/systemd/system/*.service 2>/dev/null
echo "[*] Listening services:"
ss -tlnp

echo "[+] Hardening applied. Re-enable bluetooth ONLY after patched firmware is confirmed."