Authentication Bypass and Weak Password Policy in boneIO Black

CVE-2026-77057

What is CVE-2026-77057?

The boneIO Black product exhibits a significant vulnerability that permits unauthenticated attackers to execute unlimited brute-force login attempts on its web interface and SSH service. The device does not impose limits on authentication attempts, nor does it enforce rigorous password complexity requirements. This deficiency can lead to unauthorized access and compromise of user accounts. The vulnerability has been addressed in version 1.6.0, where enhancements include rate-limiting login attempts per source and account, establishing a minimum password length of 8 characters, and limiting SSH authentication attempts to three per connection.

References