Read the docs
TI-2026-80414 Aliases CVE-2026-77056GHSA-m3h7-g9v5-p62c

Default credentials in boneIO MQTT broker allow remote control of devices

Priority LOW 31CWE-1392Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

boneIO black_debian_images ships a Mosquitto MQTT broker that uses the same default credentials on all devices, and those credentials are publicly documented. A remote attacker who knows them can gain full read and write access to the broker, controlling connected relays, blinds and gates and injecting fake entities into a linked Home Assistant installation. Devices upgraded from earlier versions keep their existing broker credentials (CWE-1392).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation. This issue was fixed in version 1.6.0 of the image: MQTT passwords are generated per device at first boot. Devices upgraded from earlier versions keep their existing broker credentials; from boneio 1.6.0 the web panel reports credentials that are still the published defaults, and the owner has to change them.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00355 29th percentileScored 2026-11-07
Fix Fixed black_debian_images (boneIO): 1.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
boneIOblack_debian_images1.2.0 to before 1.6.01.6.0Patch availableCNA
  • black_debian_images VendorboneIO Affected 1.2.0 to before 1.6.0 Fixed in 1.6.0 Patch available CNA

Remediation

Upgrade boneIO black_debian_images from 1.2.0 before 1.6.0 to version 1.6.0, which generates MQTT passwords per device at first boot. Devices upgraded from earlier versions keep their default credentials, so the owner must change them, and the web panel reports credentials that are still the published defaults.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA black_debian_images (boneIO) Fixed in 1.6.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    boneIO black_debian_images 1.6.0

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-80413 Excessive privileges in boneIO black_debian_images allow root escalationPriority MEDIUM 41
    • TI-2026-80418 boneIO black_debian_images exposes MQTT password hashes to local usersPriority LOW 29
    Show all 3 records →

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-77056
  2. 2026-10-26 CISA SSVC decision points changed
  3. 2026-10-26 Priority changed: MEDIUM → LOW
  4. 2026-10-27 Alias added: GHSA-m3h7-g9v5-p62c

References

Advisory 1

Other 1

  • TI-2026-80413 Excessive privileges in boneIO black_debian_images allow root escalation CVSS 4.0CRITICAL 9.3
  • TI-2026-80410 Missing authentication for Node-RED in boneIO CVSS 4.0HIGH 8.7
  • TI-2026-80417 Race condition in boneIO sudoers handling allows root privilege escalation CVSS 4.0HIGH 8.8
  • TI-2026-80411 Missing authentication in boneIO firmware allows remote device control CVSS 4.0HIGH 8.7
  • TI-2026-80420 Clickjacking in boneIO web interface allows unauthorized actions CVSS 4.0MEDIUM 6.9
  • TI-2026-80418 boneIO black_debian_images exposes MQTT password hashes to local users CVSS 4.0MEDIUM 6.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences