Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-53605 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user (uid 1000) passwordless sudo access to /usr/bin/systemctl with no subcommand or argument restriction. This is a local privilege escalation (LPE). Any process running as pollen can obtain full root (uid 0) on the device in three commands, with no additional vulnerability required and no user interaction. This issue has been patched in version 0.2.4.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/pollen-robotics/reachy-mini-os/commit/cee4076f36bd95a2a6b894a56a48c7e971e75445	[email protected]	Source CodeVendor
https://github.com/pollen-robotics/reachy-mini-os/releases/tag/v0.2.4	[email protected]	Release NotesVendor
https://github.com/pollen-robotics/reachy-mini-os/security/advisories/GHSA-7rhg-9v48-x3h2	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-250	Execution with Unnecessary Privileges	[email protected]
CWE-269	Improper Privilege Management	[email protected]

Affected Products

Product	Versions
Pollen Robotics Reachy Mini ISO	< 0.2.4 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 0.2.4moderate effort Workaround:moderate effort Log in as root (or via sudo -i) and execute the following commands: 1. Remove the overly broad grant (if present): rm -f /etc/sudoers.d/010_pi-nopasswd 2. Install the scoped grant: cat > /etc/sudoers.d/010-pollen-reachy << 'EOF' Cmnd_Alias REACHY = \ /usr/bin/systemctl restart reachy-mini-daemon, \ /usr/bin/systemctl restart reachy-mini-bluetooth, \ /usr/sbin/rfkill unblock bluetooth, \ /usr/sbin/rfkill unblock wifi, \ /usr/sbin/shutdown -h now, \ /bluetooth/commands/HOTSPOT.sh, \ /bluetooth/commands/WIFI_RESET.sh, \ /bluetooth/commands/SOFTWARE_RESET.sh, \ /bluetooth/commands/RESTART_DAEMON.sh pollen ALL=(root) NOPASSWD: REACHY EOF chmod 0440 /etc/sudoers.d/010-pollen-reachy 3. Validate the resulting sudoers configuration: visudo -c Verify the workaround: as the pollen user, run "sudo -n -l 2>&1 \| grep systemctl". The only matching entries should be the two pinned restart lines. If bare /usr/bin/systemctl (no subcommand) still appears in any sudoers file, the escalation primitive is still present and the workaround has not been applied correctly. Important caveat: the scoped grant is only safe if the /bluetooth/commands/*.sh scripts remain root-owned and not writable by pollen — otherwise an attacker can rewrite a permitted script and run sudo <script> to obtain root by a different path. Verify with: ls -la /bluetooth/commands/ # Each script should be owned by root:root and not group/world writable.

Product

Versions

Pollen Robotics Reachy Mini ISO

< 0.2.4 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 0.2.4moderate effort
Workaround:moderate effort
Log in as root (or via sudo -i) and execute the following commands: 1. Remove the overly broad grant (if present): rm -f /etc/sudoers.d/010_pi-nopasswd 2. Install the scoped grant: cat > /etc/sudoers.d/010-pollen-reachy << 'EOF' Cmnd_Alias REACHY = \ /usr/bin/systemctl restart reachy-mini-daemon, \ /usr/bin/systemctl restart reachy-mini-bluetooth, \ /usr/sbin/rfkill unblock bluetooth, \ /usr/sbin/rfkill unblock wifi, \ /usr/sbin/shutdown -h now, \ /bluetooth/commands/HOTSPOT.sh, \ /bluetooth/commands/WIFI_RESET.sh, \ /bluetooth/commands/SOFTWARE_RESET.sh, \ /bluetooth/commands/RESTART_DAEMON.sh pollen ALL=(root) NOPASSWD: REACHY EOF chmod 0440 /etc/sudoers.d/010-pollen-reachy 3. Validate the resulting sudoers configuration: visudo -c Verify the workaround: as the pollen user, run "sudo -n -l 2>&1 | grep systemctl". The only matching entries should be the two pinned restart lines. If bare /usr/bin/systemctl (no subcommand) still appears in any sudoers file, the escalation primitive is still present and the workaround has not been applied correctly. Important caveat: the scoped grant is only safe if the /bluetooth/commands/*.sh scripts remain root-owned and not writable by pollen — otherwise an attacker can rewrite a permitted script and run sudo <script> to obtain root by a different path. Verify with: ls -la /bluetooth/commands/ # Each script should be owned by root:root and not group/world writable.

Change History

1 change record found show changes