CVE-2026-77055
Received Received - Intake

Privilege Escalation in boneIO Debian Images

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: CERT.PL

Description
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-77055
EUVD
EUVD-2026-109950

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
boneIO black_debian_images 1.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in boneIO black_debian_images versions before 1.6.0 grants the boneio service account excessive privileges. This includes full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can exploit these privileges to escalate their access to root level.

Detection Guidance

Check if the boneio user has excessive privileges by running: id boneio to verify sudo access and docker group membership. Inspect sudoers configuration with cat /etc/sudoers.d/boneio or ls /etc/sudoers.d/ for suspicious entries.

Impact Analysis

If you are using boneIO black_debian_images versions prior to 1.6.0, a local attacker could gain root access by first compromising the boneio user account. This could lead to full system compromise, unauthorized data access, or further network infiltration.

Mitigation Strategies

Upgrade to boneIO version 1.6.0 or later to remove sudoers rules and docker group membership. After upgrading, verify migrations were applied by checking if privileged operations now use signed helpers instead of direct sudo access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77055. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart