Missing authentication in boneIO firmware allows remote device control
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
boneIO firmware from 1.0.0 before 1.6.0 ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes every endpoint without credentials, which is a missing authentication flaw (CWE-306). An unauthenticated remote attacker can fully control the device, causing denial of service, changing its configuration, and operating connected physical circuits.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuration, and operating connected physical circuits. This issue was fixed in version 1.6.0: a device without an administrator account refuses API requests until the owner creates one in the first-run wizard, and every API route is restricted to an authenticated role. Versions before 1.2.0 are based on Debian 10, are no longer supported and cannot be upgraded in place; affected devices should be re-flashed with the 1.6.0 system image.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade boneIO to version 1.6.0, which refuses API requests until the owner creates an administrator account. Devices running versions before 1.2.0 cannot be upgraded in place and must be flashed again with the 1.6.0 system image.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA boneIO (boneIO) Fixed in 1.6.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
boneIO 1.6.0
8 records Highest priority Priority MEDIUM 1 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2026-80410 Missing authentication for Node-RED in boneIOPriority MEDIUM 40
- TI-2026-80417 Race condition in boneIO sudoers handling allows root privilege escalationPriority LOW 39
- TI-2026-80420 Clickjacking in boneIO web interface allows unauthorized actionsPriority LOW 31
Timeline
- 2026-10-26 Threatist record created from CVE-2026-77053
- 2026-10-27 Alias added: GHSA-82cx-36ph-pccq
- 2026-10-27 Priority changed: MEDIUM → LOW
- 2026-11-02 CISA SSVC decision points changed
References
More boneIO vulnerabilities
- TI-2026-80413 Excessive privileges in boneIO black_debian_images allow root escalation CVSS 4.0CRITICAL 9.3
- TI-2026-80410 Missing authentication for Node-RED in boneIO CVSS 4.0HIGH 8.7
- TI-2026-80417 Race condition in boneIO sudoers handling allows root privilege escalation CVSS 4.0HIGH 8.8
- TI-2026-80420 Clickjacking in boneIO web interface allows unauthorized actions CVSS 4.0MEDIUM 6.9
- TI-2026-80414 Default credentials in boneIO MQTT broker allow remote control of devices CVSS 4.0HIGH 7.1
- TI-2026-80418 boneIO black_debian_images exposes MQTT password hashes to local users CVSS 4.0MEDIUM 6.8
Sources
- CVE-2026-77053 · CVE Program
- CVE-2026-77053 · NVD
- FIRST EPSS
- GHSA-82cx-36ph-pccq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences