CVE-2026-77052 Details
Description
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system. This issue was fixed in version 1.6.0.
A vulnerability exists in boneIO Black versions 1.3.0 prior to 1.6.0, where a Node-RED instance is exposed without authentication at the '/nodered/' path, facilitated by a Caddy reverse proxy. The Node-RED Admin API can be exploited to deploy flows that execute arbitrary system commands. This allows an unauthenticated attacker on the local network to deploy a malicious flow, leading to remote code execution and full control over the home automation system.
Users can upgrade to boneIO Black version 1.6.0, which addresses this vulnerability by securing the Node-RED instance with authentication. For versions prior to 1.2.0, which are based on Debian 10 and no longer supported, devices should be re-flashed with the 1.6.0 system image.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://boneio.eu/en/docs/black | [email protected] | Vendor |
| https://cert.pl/en/posts/2026/10/CVE-2026-77052 | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| boneIO Black | >= 1.3.0, <= 1.6.0 (semver) >= 1.0.0, <= 1.6.0 (semver) >= 1.2.0, <= 1.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |