Unauthenticated Remote Access in boneIO Black Firmware
CVE-2026-77053

8.7HIGH

Key Information:

Vendor

Boneio

Status
Boneio
Vendor
CVE Published:
26 October 2026

What is CVE-2026-77053?

The boneIO Black firmware has a serious security flaw due to disabled authentication by default, allowing unauthorized remote attackers to gain control of the device. The management web API is exposed to all network interfaces, enabling complete manipulation of device configurations, causing denial of service, and even controlling connected physical systems. This vulnerability has been addressed in version 1.6.0, which now requires an administrator account to be set up during the first-run wizard, and enforces authentication for all API routes.

Affected Version(s)

boneIO 1.0.0 < 1.6.0

References

https://cert.pl/en/posts/2026/10/CVE-2026-77052
third-party-advisory
https://boneio.eu/en/docs/black
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mateusz WĹ‚odarczak (s3ga)
.