boneIO Black includes a time‑of‑check to time‑of‑use (TOCTOU) race condition in a function that creates a temporary sudoers file and later installs it with root privileges. During the brief period between validating the file’s contents and installing it, a local attacker can replace the temporary file with malicious content or create a symbolic link that points to an arbitrary location. If successful, the attacker injects arbitrary sudoers rules, giving them root access on the host.

The vulnerability affects the boneIO boneIO product, specifically versions earlier than 1.6.0. Upgrade to 1.6.0 or later is required to remove the insecure file handling.

The CVSS score of 8.8 categorizes this bug as high risk, and although an EPSS score is not available, the lack of KEV listing does not diminish its danger. The flaw requires a local attacker with the ability to run code on the affected host to exploit the race window. Once the attack succeeds, the attacker gains unrestricted root privileges, enabling any system compromise.