Vulnerabilities

TI-2026-80418 CVE-2026-77060 · GHSA-mpp4-mc8m-6vpc

boneIO black_debian_images exposes MQTT password hashes to local users

LOW 29

boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00126 Published 2026-10-26 Fixed in 1.6.0 CWE-732

TI-2026-80414 CVE-2026-77056 · GHSA-m3h7-g9v5-p62c

Default credentials in boneIO MQTT broker allow remote control of devices

LOW 31

boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices.

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00355 Published 2026-10-26 Fixed in 1.6.0 CWE-1392

TI-2026-80413 CVE-2026-77055 · GHSA-qc57-j976-j85m

Excessive privileges in boneIO black_debian_images allow root escalation

MEDIUM 41

boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group.

CVSS 4.0CRITICAL 9.3 Local Low privileges No interaction EPSS 0.00093 Published 2026-10-26 Fixed in 1.6.0 CWE-266

Vulnerabilities

Filters

boneIO black_debian_images exposes MQTT password hashes to local users

Default credentials in boneIO MQTT broker allow remote control of devices

Excessive privileges in boneIO black_debian_images allow root escalation