Executive brief
The Reachy Mini robot's Bluetooth service requires a PIN to accept commands, but it uses a single shared authentication flag across all connecting devices rather than tracking which device completed the PIN exchange. An attacker within Bluetooth range can wait for a legitimate user to authenticate, then immediately send their own commands to the robot without knowing the PIN. This becomes dangerous when combined with other vulnerabilities that allow uploading malicious scripts and running them as root.
Technical details
The vulnerability exists in the Bluetooth service's WriteValue handler (src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py), which ignores the BlueZ-provided device identity in the options argument. The authentication state is maintained in a single shared flag on the service instance rather than per-device, allowing any nearby device to send CMD_ commands once any device has completed the PIN exchange. An attacker requires only proximity to the robot and knowledge of when legitimate authentication occurs; no PIN guessing or brute-forcing is necessary.
Affected products
- Pollen Robotics Reachy Mini
Timeline
- 2026-09-23: disclosed