CVE-2026-77053 Details
Description
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuration, and operating connected physical circuits. This issue was fixed in version 1.6.0: a device without an administrator account refuses API requests until the owner creates one in the first-run wizard, and every API route is restricted to an authenticated role. Versions before 1.2.0 are based on Debian 10, are no longer supported and cannot be upgraded in place; affected devices should be re-flashed with the 1.6.0 system image.
A vulnerability exists in boneIO Black firmware versions 1.0.0 through 1.6.0, where the management web API is accessible on all network interfaces without authentication. This allows unauthenticated remote attackers to gain full control of the device, disrupt services, alter configurations, and manage connected physical circuits. The issue arises because the API endpoints do not require credentials, leaving the device exposed to unauthorized access and manipulation.
Users can upgrade to boneIO Black version 1.6.0, which requires an administrator account to access the API. Devices running versions prior to 1.2.0 must be re-flashed with the 1.6.0 system image.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://boneio.eu/en/docs/black | [email protected] | Vendor |
| https://cert.pl/en/posts/2026/10/CVE-2026-77052 | [email protected] | BundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| boneIO Black | < 1.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |