Cross-site request forgery in boneIO Black controller
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.
Summary
boneIO Black lacks CSRF tokens and does not validate Origin or Referer headers on its state-changing API endpoints, which is a cross-site request forgery flaw (CWE-352). A remote attacker can lure a user on the internal network to a malicious webpage that sends cross-origin requests to the device, such as rebooting the controller, toggling relay circuits, controlling gates and blinds, or shutting the device down. The impact is loss of integrity and availability. Because authentication is disabled by default in a related flaw, any user on the same internal network can trigger these actions by visiting the malicious website.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin requests to the device. This allows the attacker to reboot the controller, toggle relay circuits, control gates and blinds, or shut down the device, causing loss of integrity and availability. Critically, due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website. This issue was fixed in version 1.6.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update boneIO to version 1.6.0 or later, which fixes this issue for affected versions from 1.2.0 before 1.6.0.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA boneIO (boneIO) Fixed in 1.6.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
boneIO 1.6.0
8 records Highest priority Priority MEDIUM 1 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2026-80410 Missing authentication for Node-RED in boneIOPriority MEDIUM 40
- TI-2026-80417 Race condition in boneIO sudoers handling allows root privilege escalationPriority LOW 39
- TI-2026-80411 Missing authentication in boneIO firmware allows remote device controlPriority LOW 39
Timeline
- 2026-10-26 Threatist record created from CVE-2026-77058
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-27 Alias added: GHSA-xmrj-8287-w33q
References
More boneIO vulnerabilities
- TI-2026-80413 Excessive privileges in boneIO black_debian_images allow root escalation CVSS 4.0CRITICAL 9.3
- TI-2026-80410 Missing authentication for Node-RED in boneIO CVSS 4.0HIGH 8.7
- TI-2026-80417 Race condition in boneIO sudoers handling allows root privilege escalation CVSS 4.0HIGH 8.8
- TI-2026-80411 Missing authentication in boneIO firmware allows remote device control CVSS 4.0HIGH 8.7
- TI-2026-80420 Clickjacking in boneIO web interface allows unauthorized actions CVSS 4.0MEDIUM 6.9
- TI-2026-80414 Default credentials in boneIO MQTT broker allow remote control of devices CVSS 4.0HIGH 7.1
Sources
- CVE-2026-77058 · CVE Program
- CVE-2026-77058 · NVD
- FIRST EPSS
- GHSA-xmrj-8287-w33q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences