[ Vendor · 11 CVEs ]
boneIO
CVEs affecting boneIO published in the last 30 days, plus any boneIO CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-77061 | 26 Oct 2026 | CVSS 5.3 | boneIOboneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve… | |
| CVE-2026-77062 | 26 Oct 2026 | CVSS 6.9 | boneIOThe boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malicious web… | |
| CVE-2026-77055 | 26 Oct 2026 | CVSS 9.3 | boneIO black_debian_imagesboneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the… | |
| CVE-2026-77056 | 26 Oct 2026 | CVSS 7.1 | boneIO black_debian_imagesboneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly… | |
| CVE-2026-77057 | 26 Oct 2026 | CVSS 2.3 | boneIOboneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity… | |
| CVE-2026-77058 | 26 Oct 2026 | CVSS 5.1 | boneIOboneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does not… | |
| CVE-2026-77059 | 26 Oct 2026 | CVSS 8.8 | boneIOboneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The… | |
| CVE-2026-77060 | 26 Oct 2026 | CVSS 6.8 | boneIO black_debian_imagesboneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user… | |
| CVE-2026-77052 | 26 Oct 2026 | CVSS 8.7 | boneIOboneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows… | |
| CVE-2026-77053 | 26 Oct 2026 | CVSS 8.7 | boneIOboneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all… | |
| CVE-2026-77054 | 26 Oct 2026 | CVSS 6.9 | boneIOboneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full… |