CVE-2026-53605

Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant

Published Sep 30, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user (uid 1000) passwordless sudo access to /usr/bin/systemctl with no subcommand or argument restriction. This is a local privilege escalation (LPE). Any process running as pollen can obtain full root (uid 0) on the device in three commands, with no additional vulnerability required and no user interaction. This issue has been patched in version 0.2.4.

Analysis

Technical impact

The vulnerability resides in the operating system image for the Reachy Mini Wireless robot. Because the sudoers file contains an overly broad rule, the pollen daemon user (uid 1000) can invoke /usr/bin/systemctl with passwordless sudo access and no restriction on subcommands. A local process running as that user can thus elevate to root in a single command, giving full control over the device. This weakness is mapped to CWE‑250 and CWE‑269.

Affected Systems

All Reachy Mini Wireless OS images shipped by pollen-robotics before version 0.2.4 are affected. The issue was fixed in the 0.2.4 release, which removes the unrestricted sudoers entry for /usr/bin/systemctl.

Risk and Exploitability

With a CVSS score of 7.8, the vulnerability carries a high local impact. The attack requires only local access and no additional vulnerabilities; any process running as the pollen daemon can simply execute systemctl to gain root. No EPSS data is available and the flaw is not yet listed in CISA KEV, but the lack of restrictions means the risk remains significant for devices in use.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

pollen-robotics

reachy-mini-os

affected

Version	Status	Constraints
`< 0.2.4`	affected	—

No data.

Vendor Product Versions

Pollen-robotics

Reachy Mini

Version	Status	Scheme	Platform
`[0,0.2.4)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Reachy Mini OS version 0.2.4 or newer, which removes the unrestricted sudoers entry.
Rebuild a custom image with pi-gen, omitting the problematic sudoers line or applying a restrictive rule that limits the pollen user to specific systemctl subcommands.
If an update cannot be performed immediately, modify the sudoers configuration to remove the pollen user from passwordless sudo rights for systemctl, and restart related services to enforce the change.

Generated by OpenCVE AI on September 30, 2026 at 20:02 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.126% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/pollen-robotics/reachy-mini-os/commit/cee4076f36bd95a2a6b894a56a48c7e971e75445
https://github.com/pollen-robotics/reachy-mini-os/releases/tag/v0.2.4
https://github.com/pollen-robotics/reachy-mini-os/security/advisories/GHSA-7rhg-9v48-x3h2

History

Oct 2, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 1, 2026 7:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Pollen-robotics Pollen-robotics reachy Mini
Vendors & Products		Pollen-robotics Pollen-robotics reachy Mini

Sep 30, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user (uid 1000) passwordless sudo access to /usr/bin/systemctl with no subcommand or argument restriction. This is a local privilege escalation (LPE). Any process running as pollen can obtain full root (uid 0) on the device in three commands, with no additional vulnerability required and no user interaction. This issue has been patched in version 0.2.4.
Title		Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant
Weaknesses		CWE-250 CWE-269
References		https://github.com/pollen-robotics/reachy-mini-os/commit/cee4076f36bd95a2a6b894a56a48c7e971e75445 https://github.com/pollen-robotics/reachy-mini-os/releases/tag/v0.2.4 https://github.com/pollen-robotics/reachy-mini-os/security/advisories/GHSA-7rhg-9v48-x3h2
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`