8.8
HighCVSS 4.0 · from CERT-PL
CVE-2026-77059
TOCTOU Race Condition in boneIO
boneio · CWE-367 · CWE-367Affectedboneio
FixUpdate to 1.6.0 or newer
PublishedOct 26, 14:46 · CERT-PL
ScoredOct 26 · 8.8 · CERT-PL
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges. A local attacker can exploit the race window between validation and installation to substitute malicious content, or use the predictable filename for symlink attacks, resulting in arbitrary sudoers rule injection and local privilege escalation to root. This issue was fixed in version 1.6.0.
From CERT-PL
Affected and fixed versions
ProductAffectedFixed inboneio1.3.0 – before 1.6.01.6.0
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known