Remote Access Vulnerability in Mosquitto MQTT Broker of boneIO black_debian_images

CVE-2026-77056

What is CVE-2026-77056?

The Mosquitto MQTT broker included in boneIO black_debian_images utilizes identical default credentials across all devices. These credentials are openly available on GitHub, and the setup instructions do not advise users to change them. As a result, unauthorized users can exploit this vulnerability to gain complete read and write access to the broker, thereby controlling connected devices such as relays, blinds, and gates. Additionally, attackers can inject deceptive entities into a linked Home Assistant setup. Version 1.6.0 of boneIO addresses this issue by generating unique MQTT passwords for each device during the initial boot process. However, devices upgraded from earlier versions retain their prior credentials unless manually modified by the owner.

References