Description
Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user (uid 1000) passwordless sudo access to /usr/bin/systemctl with no subcommand or argument restriction. This is a local privilege escalation (LPE). Any process running as pollen can obtain full root (uid 0) on the device in three commands, with no additional vulnerability required and no user interaction. This issue has been patched in version 0.2.4.
Published: 2026-09-30
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the operating system image for the Reachy Mini Wireless robot. Because the sudoers file contains an overly broad rule, the pollen daemon user (uid 1000) can invoke /usr/bin/systemctl with passwordless sudo access and no restriction on subcommands. A local process running as that user can thus elevate to root in a single command, giving full control over the device. This weakness is mapped to CWE‑250 and CWE‑269.

Affected Systems

All Reachy Mini Wireless OS images shipped by pollen-robotics before version 0.2.4 are affected. The issue was fixed in the 0.2.4 release, which removes the unrestricted sudoers entry for /usr/bin/systemctl.

Risk and Exploitability

With a CVSS score of 7.8, the vulnerability carries a high local impact. The attack requires only local access and no additional vulnerabilities; any process running as the pollen daemon can simply execute systemctl to gain root. No EPSS data is available and the flaw is not yet listed in CISA KEV, but the lack of restrictions means the risk remains significant for devices in use.

Generated by OpenCVE AI on September 30, 2026 at 20:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Reachy Mini OS version 0.2.4 or newer, which removes the unrestricted sudoers entry.
  • Rebuild a custom image with pi-gen, omitting the problematic sudoers line or applying a restrictive rule that limits the pollen user to specific systemctl subcommands.
  • If an update cannot be performed immediately, modify the sudoers configuration to remove the pollen user from passwordless sudo rights for systemctl, and restart related services to enforce the change.

Generated by OpenCVE AI on September 30, 2026 at 20:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Pollen-robotics
Pollen-robotics reachy Mini
Vendors & Products Pollen-robotics
Pollen-robotics reachy Mini

Wed, 30 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user (uid 1000) passwordless sudo access to /usr/bin/systemctl with no subcommand or argument restriction. This is a local privilege escalation (LPE). Any process running as pollen can obtain full root (uid 0) on the device in three commands, with no additional vulnerability required and no user interaction. This issue has been patched in version 0.2.4.
Title Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant
Weaknesses CWE-250
CWE-269
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Pollen-robotics Reachy Mini
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-30T17:09:23.367Z

Reserved: 2026-06-09T19:39:52.404Z

Link: CVE-2026-53605

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-30T18:18:37.213

Modified: 2026-09-30T19:57:08.043

Link: CVE-2026-53605

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T19:30:11Z

Weaknesses
  • CWE-250

    Execution with Unnecessary Privileges

  • CWE-269

    Improper Privilege Management