boneIO black_debian_images: Privilege escalation via excessive service account rights
Summary
boneIO black_debian_images gives the boneio service account full passwordless sudo rights and membership in the docker group. A local attacker who has compromised the boneio account can use these rights to escalate to root on the controller. Exploitation requires a prior foothold as the boneio user.
Affected
- boneIO black_debian_images, versions 1.2.0 to before 1.6.0
Fixed in
- Upgrade to boneIO 1.6.0 or later. The migrations shipped with 1.6.0 remove the sudoers rule and docker group membership on first start after the upgrade.
Workaround
- No vendor workaround known.
- Unvetted third-party suggestion: remove the passwordless sudo entry and the docker group membership of the boneio user and restrict it to required capabilities. Test on a spare unit first, as boneIO may depend on these grants.
- Restrict network access to the device's web interface.
Exploitation
- Not known to be exploited in the wild.
- Not listed in the CISA KEV catalog.
- No public proof of concept found; this does not prove that none exists.
Our recommendation
- Upgrade all boneIO Black devices to version 1.6.0 or later and verify that the first start migrations completed.
- Check the vendor page https://boneio.eu/en/docs/black for the current advisory before rollout.
- Patch together with CVE-2026-77052 to CVE-2026-77062, as the 1.6.0 release fixes them jointly.
- Restrict access to the controller's network and web interface, and monitor for unexpected root activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska advisory (CNA) cert.pl
- boneIO Black documentation (vendor) boneio.eu
- OpenCVE CVE-2026-77055 app.opencve.io
- OffSeq CVE-2026-77055 radar.offseq.com
- Strix CVE-2026-77055 www.strix.ai
- VulDB entry 426470 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:42.
Original description (NVD)
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.