Reachy Mini Os
Monthly
Local privilege escalation on Reachy Mini Wireless robots running OS images built from pollen-robotics/reachy-mini-os prior to v0.2.4, where a sudoers entry granted the low-privileged pollen daemon user (uid 1000) passwordless root access to /usr/bin/systemctl with no subcommand or argument restriction. Any code already executing as pollen - for example through a compromised reachy daemon - can escalate to full root (uid 0) without user interaction or a TTY, because systemctl can be pointed at an attacker-supplied unit file whose ExecStart runs as root. Rated CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), confirmed by the vendor advisory GHSA-7rhg-9v48-x3h2 and closed by release v0.2.4; no public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires an existing foothold as the pollen user on an unpatched image.
Local privilege escalation on Reachy Mini Wireless robots running OS images built from pollen-robotics/reachy-mini-os prior to v0.2.4, where a sudoers entry granted the low-privileged pollen daemon user (uid 1000) passwordless root access to /usr/bin/systemctl with no subcommand or argument restriction. Any code already executing as pollen - for example through a compromised reachy daemon - can escalate to full root (uid 0) without user interaction or a TTY, because systemctl can be pointed at an attacker-supplied unit file whose ExecStart runs as root. Rated CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), confirmed by the vendor advisory GHSA-7rhg-9v48-x3h2 and closed by release v0.2.4; no public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires an existing foothold as the pollen user on an unpatched image.