The vulnerability is an improper privilege assignment in boneIO black_debian_images. The boneio service account is given excessive permissions, including full passwordless sudo rights and membership in the docker group. If an attacker compromises the local boneio user account, he can use these privileges to elevate to full root access.

The affected product is boneIO black_debian_images. All versions prior to 1.6.0 are impacted; the issue was fixed in image version 1.6.0, where the sudoers rule and docker group membership are removed and a migration process is applied on first start after upgrade.

This flaw achieves a CVSS score of 9.3, indicating a high severity of privilege escalation. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local; a threat actor who can compromise the boneio user on the host can exploit the excess privileges to gain full root control. Given the lack of external exposure, the risk is primarily limited to environments where the boneio container has been compromised locally.