Clickjacking Vulnerability in BoneIO Black Web Interface

CVE-2026-77062

What is CVE-2026-77062?

The BoneIO Black web interface is vulnerable to clickjacking attacks due to inadequate protective measures. An attacker can exploit this vulnerability by embedding the control panel in a malicious iframe, deceiving authenticated users on the internal network into clicking on buttons that perform unintended actions, such as activating relays or opening gates. This exposure can lead to unauthorized manipulation of connected systems, potentially resulting in safety hazards. The flaw stems from a lack of proper authentication controls, making it possible for any user on the same internal network to trigger these malicious actions simply by visiting an attacker-controlled webpage. The issue was addressed in version 1.6.0.

References