Cleartext Password Exposure in boneIO Black Product

CVE-2026-77054

What is CVE-2026-77054?

The boneIO Black product has a significant vulnerability that allows authenticated users to access sensitive passwords, including those for the MQTT broker and web panel, stored in plaintext. This risk is exacerbated by an authentication weakness that permits unauthenticated attackers on the local network to exploit the /api/config endpoint and retrieve administrative credentials. The issue has been addressed in version 1.6.0, where web panel passwords are now stored as salted scrypt hashes and sensitive information is no longer disclosed through the API.

References