Zero Radar
← feed
CriticalVulnerabilityCVE-2026-77055updated 26 Oct 2026, 15:21 UTC

boneIO devices let a compromised service account gain full root control

The boneIO service account on these devices has far more power than it needs. If an attacker gets into that account, they can take over the whole device.

Fix availableOfficial source
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesboneIO 1.6.0. The image removes the sudoers rule and docker group membership, and migrations shipped with 1.6.0 remove them from devices already in the field on first start after upgrade. · since 26 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Local attackerAlready has access to the device
  2. 2boneio accountCompromised service account
  3. 3Passwordless sudoExcess privileges granted to boneio
  4. 4Root accessEscalates to full control
  5. ResultAttacker gains root on the device

What happened

The boneio service account in boneIO black_debian_images has passwordless full sudo rights and membership in the docker group, allowing local privilege escalation to root.

Why it is dangerous: An attacker who compromises the boneio user, for example through another weakness, can become root on the device and control everything on it.

Are you affected?

You are affected if you run boneIO black_debian_images devices with a boneio version earlier than 1.6.0.

boneIO black_debian_images, all versions before 1.6.0 (boneio service account with passwordless sudo and docker group membership).

What to do

  1. Upgrade boneIO to version 1.6.0 or later on every device
  2. Confirm the migrations ran on first start, so the boneio account no longer has sudo rights or docker group membership
  3. Check that the boneio account cannot run sudo without a password or access the docker group

Timeline

  1. 26 Oct 2026, 15:16 UTC
    Publicly disclosed
  2. 26 Oct 2026, 15:16 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 15:21 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-77055
CVSS
9.3 / 10
EPSS
0.1% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 15:16 UTC
On Zero Radar
26 Oct 2026, 15:21 UTC (5 min after disclosure)
Last change
26 Oct 2026, 15:21 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

boneIO devices let a compromised service account gain full root control · Zero Radar