CVE-2026-77059

The boneIO Black software contains a TOCTOU (Time-of-Check Time-of-Use) race condition within the create_timedatectl_sudoers_file() function of the boneio/webui/routes/timezone_sudoers.py file. The vulnerability arises because the function writes sudoers rules to a predictable temporary file , pe...

CVE-2026-77059 TOCTOU Race Condition in boneIO

boneIO Black contains a TOCTOU race condition in the createtimedatectlsudoersfile function in boneio/webui/routes/timezonesudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges. A local attacker can exploit the race...

EUVD-2026-109954

boneIO Black contains a TOCTOU race condition in the createtimedatectlsudoersfile function in boneio/webui/routes/timezonesudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges. A local attacker can exploit the race...

CVE-2026-77058

boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints. The root cause is the absence of CSRF tokens and a failure to validate Origin or Referer headers. A remote attacker can lure a user on the internal network to a malicious webpage that sends cross-...

CVE-2026-77058 Cross-Site Request Forgery (CSRF) in boneIO

boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...

EUVD-2026-109953

boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...

CVE-2026-77057

The boneIO Black platform is vulnerable to brute-force attacks because it fails to limit authentication attempts on its web interface (POST /api/login) and SSH service , while also lacking password complexity requirements. An unauthenticated remote attacker can perform unlimited login attempts to...

EUVD-2026-109952

boneIO Black does not limit authentication attempts on its web interface POST /api/login or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized acce...

CVE-2026-77056

The boneIO black_debian_images software is vulnerable to a Use of Default Credentials issue (CWE-1392) because the included Mosquitto MQTT broker uses identical, publicly documented default credentials across all devices. A remote attacker could exploit this to gain full read and write access to ...

CVE-2026-77056 Use of Default Credentials in boneIO

boneIO blackdebianimages ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access ...

EUVD-2026-109951

boneIO blackdebianimages ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access ...

EUVD-2026-109950

boneIO blackdebianimages gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This issue was fixed in version 1.6.0: the ima...

CVE-2026-77055

The boneIO black_debian_images provide the boneio service account with excessive privileges, specifically including full passwordless sudo access and membership in the docker group . A local attacker who compromises the boneio user can leverage these privileges to escalate to root privileges. Thi...

CVE-2026-77054 Cleartext Storage of Sensitive Information in boneIO

boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the endpoint and access the administrative passwords in cleartext form...

EUVD-2026-109949

boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the endpoint and access the administrative passwords in cleartext form...

CVE-2026-77054

The boneIO Black software is vulnerable to cleartext storage of sensitive information, specifically MQTT broker and web panel passwords. The GET /api/config endpoint exposes these passwords in cleartext to any authenticated user. Furthermore, because authentication is disabled by default (CVE-202...

CVE-2026-77053

The boneIO Black firmware is vulnerable to missing authentication, where the management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, leading to denial of service , configuration ...

EUVD-2026-109948

boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuratio...

EUVD-2026-109947

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

CVE-2026-77052

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path via a Caddy reverse proxy. An unauthenticated attacker on the local network can exploit the Node-RED Admin API to deploy malicious flows, leading to remote code execution and full control over the home automatio...