Unauthenticated API Access Vulnerability in boneIO Black by BoneIO

CVE-2026-77061

What is CVE-2026-77061?

The boneIO Black device has a vulnerability that allows unauthenticated remote attackers on the local network to access several API endpoints without proper authentication. This security flaw enables potential attackers to obtain sensitive information such as system logs, firmware versions, serial numbers, MQTT usernames, and configuration file listings. This data can facilitate reconnaissance operations, thereby increasing the risk of targeted attacks against the device. The vulnerability was addressed in version 1.6.0, where all API routes were secured with authenticated roles, the interactive API documentation was disabled, and serial numbers were withheld from unauthorized requests.

References