Read the docs
TI-2026-80420 Aliases CVE-2026-77062GHSA-gfxc-7hmj-qcg2

Clickjacking in boneIO web interface allows unauthorized actions

Priority LOW 31CWE-1021Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-1021.

Summary

boneIO, a boneIO Black web interface, lacks proper clickjacking protections in versions from 1.2.0 before 1.6.0. A remote attacker can embed the control panel in an iframe on a malicious web page and trick an authenticated user on the internal network into clicking buttons that change device states, such as activating relays or opening gates. The flaw is CWE-1021, improper restriction of rendered UI layers or frames, and it can lead to unauthorized state changes with potential physical safety consequences.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malicious web page and trick an authenticated user on the internal network into clicking buttons that activate relays, open gates, or control blinds. This can lead to unauthorized state changes with potential physical safety consequences. Critically, due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website. This issue was fixed in version 1.6.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Fix Fixed boneIO (boneIO): 1.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
boneIOboneIO1.2.0 to before 1.6.01.6.0Patch availableCNA
  • boneIO VendorboneIO Affected 1.2.0 to before 1.6.0 Fixed in 1.6.0 Patch available CNA

Remediation

Update boneIO to version 1.6.0 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA boneIO (boneIO) Fixed in 1.6.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    boneIO 1.6.0

    8 records Highest priority Priority MEDIUM 1 MEDIUM, 7 LOW

    Other records, highest priority first

    • TI-2026-80410 Missing authentication for Node-RED in boneIOPriority MEDIUM 40
    • TI-2026-80417 Race condition in boneIO sudoers handling allows root privilege escalationPriority LOW 39
    • TI-2026-80411 Missing authentication in boneIO firmware allows remote device controlPriority LOW 39
    Show all 8 records →

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-77062
  2. 2026-10-26 CISA SSVC decision points changed
  3. 2026-10-26 Priority changed: MEDIUM → LOW
  4. 2026-10-27 Alias added: GHSA-gfxc-7hmj-qcg2

References

Advisory 1

Other 1

  • TI-2026-80413 Excessive privileges in boneIO black_debian_images allow root escalation CVSS 4.0CRITICAL 9.3
  • TI-2026-80410 Missing authentication for Node-RED in boneIO CVSS 4.0HIGH 8.7
  • TI-2026-80417 Race condition in boneIO sudoers handling allows root privilege escalation CVSS 4.0HIGH 8.8
  • TI-2026-80411 Missing authentication in boneIO firmware allows remote device control CVSS 4.0HIGH 8.7
  • TI-2026-80414 Default credentials in boneIO MQTT broker allow remote control of devices CVSS 4.0HIGH 7.1
  • TI-2026-80418 boneIO black_debian_images exposes MQTT password hashes to local users CVSS 4.0MEDIUM 6.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences