Threat database

Reachy Mini Wireless OS images prior to version 0.2.4 contain a local privilege escalation vulnerability due to an overly broad sudoers entry. The pollen daemon user (uid 1000) has passwordless sudo access to /usr/bin/systemctl without restrictions, allowing any process running as pollen to gain full root privileges. This issue has been patched in version 0.2.4.

Reachy Mini SDK versions prior to 1.8.2 have an unauthenticated file upload vulnerability at the /api/media/sounds/upload endpoint. This endpoint lacks authentication, file extension checks, content validation, and size validation, allowing an attacker to upload arbitrary files. The daemon binds to all interfaces (0.0.0.0) and permits all CORS origins, increasing exposure. Uploaded files are stored in /tmp/reachy_mini_sounds/ with their original filenames. This can lead to integrity compromise of stored data and potentially serve as a foothold if combined with other vulnerabilities. The issue is fixed in version 1.8.2.