TI-2026-80420 CVE-2026-77062 · GHSA-gfxc-7hmj-qcg2
Clickjacking in boneIO web interface allows unauthorized actions
Priority LOW 31
The boneIO Black web interface lacks proper clickjacking protections.
Vulnerabilities
8 records
TI-2026-80419 CVE-2026-77061 · GHSA-g7w6-5jxq-p6fc
Missing authentication exposes boneIO Black API data
Priority LOW 24
boneIO Black directly excludes several API endpoints from the authentication.
TI-2026-80417 CVE-2026-77059 · GHSA-69w9-6j7r-c8fv
Race condition in boneIO sudoers handling allows root privilege escalation
Priority LOW 39
boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py.
TI-2026-80416 CVE-2026-77058 · GHSA-xmrj-8287-w33q
Cross-site request forgery in boneIO Black controller
Priority LOW 23
boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers.
TI-2026-80415 CVE-2026-77057 · GHSA-7xx2-3f83-327p
Missing authentication attempt limits in boneIO allow brute-force logins
Priority LOW 14
boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity.
TI-2026-80412 CVE-2026-77054 · GHSA-vr49-42jp-v28f
Cleartext storage of passwords in boneIO
Priority LOW 29
boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext.
TI-2026-80411 CVE-2026-77053 · GHSA-82cx-36ph-pccq
Missing authentication in boneIO firmware allows remote device control
Priority LOW 39
boneIO Black firmware ships with authentication disabled by default.
TI-2026-80410 CVE-2026-77052 · GHSA-wq8m-48jg-3x9h
Missing authentication for Node-RED in boneIO
Priority MEDIUM 40
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy.