Hack One Robot, Reach the Next: Unitree G1 Security Flaws

A security researcher has discovered a chain of two vulnerabilities in the Unitree G1 humanoid robot that allows for remote, unauthenticated root access. The flaws can be exploited through a combination of Bluetooth, Unitree's cloud infrastructure, and the mobile app, enabling an attacker to compromise a robot and then use it to attack other nearby robots. Unitree has since patched the cloud vulnerability and issued bounties for the discovered flaws.