On 26 October 2026 CERT Polska published 11 vulnerabilities in boneIO products, CVE-2026-77052 to CVE-2026-77062. They affect the boneIO Black controller software and the black_debian_images system image, and boneIO fixed them in version 1.6.0. The flaws were reported by Mateusz Włodarczak (s3ga), and CERT Polska coordinated the disclosure. The advisory does not mention any attacks in the wild.

boneIO Black drives relays, blinds and gates, so the worst cases here are physical, not just a leaked password.

The serious ones

  • CVE-2026-77052: a Node-RED instance sits at /nodered/ behind the Caddy reverse proxy with no authentication. Node-RED's admin API can deploy flows that run system commands, so anyone on the local network can take over the controller. Affects 1.3.0 and later.
  • CVE-2026-77053: authentication is off by default and the management API listens on every network interface. Without credentials, an attacker can change the configuration, cause a denial of service and switch connected circuits.
  • CVE-2026-77054: passwords, including the MQTT broker and web panel ones, are stored in cleartext, and GET /api/config returns them. Combined with the previous flaw, anyone on the network can read them.
  • CVE-2026-77056: the bundled Mosquitto broker uses the same default credentials on every device, and they are published on GitHub. With them an attacker can read and write all topics, operate relays, blinds and gates, and inject fake entities into a linked Home Assistant.
  • CVE-2026-77055 and CVE-2026-77059: the boneio service account had passwordless sudo and docker group membership, and a race condition in the timezone sudoers helper allowed injecting sudoers rules. Both lead from a local foothold to root.

The rest cover a world-readable /etc/mosquitto/passwd file (77060), no limit on login attempts over the web panel or SSH (77057), no CSRF protection (77058), API endpoints that leak logs, firmware version, serial number and the MQTT username without login (77061), and missing clickjacking protection (77062). Because authentication was off by default, the CSRF and clickjacking flaws could be triggered just by someone on the home network visiting a malicious web page.

What 1.6.0 changes

  • A device without an admin account refuses API requests until the owner creates one in the first-run wizard, and every route requires an authenticated role.
  • Panel passwords are stored as salted scrypt hashes, and the API and logs no longer return secrets.
  • MQTT passwords are generated per device at first boot. Upgraded devices keep their old broker credentials, but the panel now warns when they are still the published defaults, and you have to change them yourself.
  • The sudoers rule and docker group membership are removed, and privileged actions go through helpers that accept only a fixed set of commands.
  • Web logins are rate-limited, panel passwords need at least 8 characters, and SSH allows three attempts per connection.

Versions before 1.2.0 run on Debian 10, are no longer supported and cannot be upgraded in place. Those devices need to be re-flashed with the 1.6.0 image.

What to do now

Update to 1.6.0, create the admin account, and change the MQTT password if the panel flags it. Until then, keep the controller on a separate network segment that guests and ordinary devices can't reach, and don't expose port 8443 or the broker to the internet. If you use the broker with Home Assistant, update the MQTT integration with the new password afterwards.