CSRF Vulnerability in boneIO Black by boneIO

CVE-2026-77058

What is CVE-2026-77058?

The boneIO Black device is susceptible to Cross-Site Request Forgery on all state-changing API endpoints due to the absence of CSRF tokens and inadequate validation of Origin or Referer headers. This vulnerability allows remote attackers to create malicious webpages that, when accessed by users on the internal network, can send unauthorized cross-origin requests to the device. Consequently, attackers can manipulate critical functions such as rebooting the controller, toggling relay circuits, or controlling gates and blinds, ultimately jeopardizing the device's integrity and availability. This vulnerability is exacerbated by the fact that authentication is disabled by default in the affected product, enabling any local network user to exploit the flaw simply by visiting the malicious site. The issue was addressed in version 1.6.0.

References