Threat video1:00
CVE-2026-96455 Reachy Mini Daemon RCE: Detection & IOCs
One unauthenticated request to the Reachy Mini daemon runs attacker code; 9 detection rules, 16 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for CVE-2026-96455 Reachy Mini Daemon RCE: Detection & IOCs →
Chapters
- 0:00The hookFive vulnerabilities chain to root.
- 0:04The storyReported in May.
- 0:10Attack pathBluetooth authentication race exposes device commands.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise16 indicators to hunt: 1 IP, 2 domains and 6 URLs, and more.
- 0:38MITRE ATT&CK techniques9 ATT&CK techniques, from initial access to credential access.
- 0:43Remediation5 steps now: Block TCP 8000 on the robot's WLAN interface.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Five vulnerabilities chain to root.
0:05Reported in May. Now published with the full attack chain.
0:11Bluetooth authentication race exposes device commands.
0:15Arbitrary file upload accepted without restriction.
0:18Path traversal executes scripts with root privilege.
0:21SSH key injection ensures persistent compromise.
0:28No threat actor is attributed. Confidence: low.
0:3216 indicators to hunt: 1 IP, 2 domains and 6 URLs, and more.
0:399 ATT&CK techniques, from initial access to credential access.
0:445 steps now: Block TCP 8000 on the robot's WLAN interface.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.