These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A clickjacking vulnerability exists in the boneIO Black web interface. An attacker can embed the control panel in an iframe on a malicious webpage, tricking authenticated users on the internal network into performing unintended actions, potentially leading to unauthorized state changes with physical safety consequences. This issue was fixed in version 1.6.0. Defenders should assess exposure and prioritize [truncated]
An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation from boneIO Black. This issue was fixed in version 1.6.0, where every API route requires an authenticated role, the interactive API documentation is disabled, and the serial number is withheld from anonymous callers. The vulner [truncated]
CVE-2026-77060 debrief based on CVE Program and NVD records. Local users can read Mosquitto MQTT broker password hashes due to world-readable permissions. This issue was fixed in version 1.6.0. System administrators and security teams should assess exposure and prioritize updating to version 1.6.0 or later. The boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/pas [truncated]
A TOCTOU race condition exists in boneIO Black's create_timedatectl_sudoers_file() function, allowing local attackers to inject malicious sudoers rules and escalate privileges to root. This issue was fixed in version 1.6.0. The vulnerability arises from the function's writing of sudoers rules to a predictable temporary file, validating them, then installing them with root privileges. An attacker can explo [truncated]
A Cross-Site Request Forgery (CSRF) vulnerability exists in boneIO Black due to the lack of CSRF tokens and insufficient validation of Origin or Referer headers. This issue allows a remote attacker to craft a malicious webpage that, when visited by a user on the internal network, can send cross-origin requests to the device, potentially leading to loss of integrity and availability.
The CVE-2026-77057 vulnerability in boneIO Black allows unlimited brute-force login attempts due to a lack of authentication attempt limits on its web interface (POST /api/login) and SSH service, as well as a lack of password complexity enforcement. This issue was fixed in version 1.6.0, which implemented rate limiting for web login attempts per source address and per account, required panel passwords to [truncated]
CVE-2026-77056 debrief based on CVE Program and NVD records. boneIO black_debian_images ships with default Mosquitto MQTT broker credentials publicly documented on GitHub, allowing remote attackers to gain full read and write access to the broker. This issue was fixed in version 1.6.0. The vulnerability allows attackers to control connected relays, blinds, and gates, and inject fake entities into linked H [truncated]
A critical vulnerability was found in boneIO's black_debian_images, which gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. This issue allows a local attacker to escalate privileges to root. The vulnerability was fixed in version 1.6.0 by removing sudoers rules and docker group membership when the image is sealed, and devices [truncated]
CVE-2026-77054 debrief based on CVE Program and NVD records. boneIO stores passwords in cleartext, exposing them via the GET /api/config endpoint. Authenticated users can access administrative passwords, and due to CVE-2026-77053, unauthenticated local network attackers can also retrieve passwords. The vulnerability was fixed in version 1.6.0, which stores web panel passwords as salted scrypt hashes and k [truncated]
PatchSiren debrief for CVE-2026-77053: Missing Authentication in Default Configuration in boneIO. The boneIO Black firmware ships with authentication disabled by default, allowing unauthenticated remote attackers to fully control the device, which can lead to denial of service, configuration modification, and operation of connected physical circuits. This issue was fixed in version 1.6.0, where a device w [truncated]
This PatchSiren debrief provides defensive context on CVE-2026-77052, a high-severity vulnerability in boneIO Black that exposes a Node-RED instance without authentication. The issue allows unauthenticated attackers on the local network to deploy malicious flows, potentially leading to remote code execution and full control over the home automation system.