UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot (13 minute read)
A disclosure chains a Bluetooth characteristic that accepts writes without pairing, a heredoc injection that hijacks WiFi, a path traversal in the robot's chatbot and a 1050-byte buffer overflow into root code execution on a Unitree G1. A cloud API decrypts any G1's AES key from a free account without checking ownership, and the exploit is wormable; it produced two CVEs and a $6,700 bounty. It follows UniPwn and Unitree's first mitigations, by a different chain.