CVE-2026-53605

Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant

State: Published
Severity: 7.8 High
Published: Sep 30, 2026
Updated: Oct 2, 2026
Reserved: Jun 9, 2026

Description

Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user (uid 1000) passwordless sudo access to /usr/bin/systemctl with no subcommand or argument restriction. This is a local privilege escalation (LPE). Any process running as pollen can obtain full root (uid 0) on the device in three commands, with no additional vulnerability required and no user interaction. This issue has been patched in version 0.2.4.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-250 Execution with Unnecessary Privileges
CWE-269 Improper Privilege Management

Affected Products

Product	Versions
reachy-mini-ospollen-robotics	< 0.2.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.