CVE-2026-77055

boneIO blackdebianimages gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This issue was fixed in version 1.6.0: the ima...

CVE-2026-77056

boneIO blackdebianimages ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access ...

CVE-2026-77060

boneIO blackdebianimages stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks. This issue was fixed in version 1.6.0...

CVE-2026-77060 Incorrect Permission Assignment for Critical Resource in boneIO

boneIO blackdebianimages stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks. This issue was fixed in version 1.6.0...

EUVD-2026-109955

boneIO blackdebianimages stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks. This issue was fixed in version 1.6.0...

CVE-2026-77060

The boneIO black_debian_images product incorrectly configures permissions for the Mosquitto MQTT broker password file located at /etc/mosquitto/passwd . Because the file is stored with world-readable permissions , any local user can access the password hashes for all MQTT accounts, enabling them ...

EUVD-2026-109951

boneIO blackdebianimages ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access ...

CVE-2026-77056 Use of Default Credentials in boneIO

boneIO blackdebianimages ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access ...

CVE-2026-77056

The boneIO black_debian_images software is vulnerable to a Use of Default Credentials issue (CWE-1392) because the included Mosquitto MQTT broker uses identical, publicly documented default credentials across all devices. A remote attacker could exploit this to gain full read and write access to ...

EUVD-2026-109950

boneIO blackdebianimages gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This issue was fixed in version 1.6.0: the ima...

CVE-2026-77055

The boneIO black_debian_images provide the boneio service account with excessive privileges, specifically including full passwordless sudo access and membership in the docker group . A local attacker who compromises the boneio user can leverage these privileges to escalate to root privileges. Thi...