CVE-2026-77058 Details
Description
boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin requests to the device. This allows the attacker to reboot the controller, toggle relay circuits, control gates and blinds, or shut down the device, causing loss of integrity and availability. Critically, due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website. This issue was fixed in version 1.6.0.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in boneIO Black, affecting all versions from 1.2.0 to 1.6.0. The vulnerability arises because the device's state-changing API endpoints lack CSRF tokens and do not properly validate Origin or Referer headers. This allows remote attackers to create malicious webpages that, when accessed by users on the internal network, can send cross-origin requests to the device. Exploitation of this vulnerability could enable attackers to reboot the controller, toggle relay circuits, control gates and blinds, or shut down the device, leading to unauthorized changes in device state and potential physical safety risks.
This vulnerability was fixed in boneIO Black version 1.6.0. Users should upgrade to this version to address the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://boneio.eu/en/docs/black | [email protected] | ProductVendor |
| https://cert.pl/en/posts/2026/10/CVE-2026-77052 | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| boneIO Black | >= 1.2.0, <= 1.6.0 (semver) |
CPE
Remediation
| |
| boneIO Black 32x10A | All versions |
CPE
Remediation
| |
| boneIO Black Cover Mix | All versions |
CPE
Remediation
| |
| boneIO Black Cover | All versions |
CPE
Remediation
| |
| boneIO Black 24x16A | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |