Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

boneIO allows full remote control without login

CVE-2026-77053 · published 1 day ago
Summary

The boneIO device runs its web management interface openly, letting anyone on the network change settings, shut it down, or control attached hardware. Upgrade to version 1.6.0 or re-flash older units with the new system image to require a password before any API actions are allowed.

What to do
  • Update boneio boneio to version 1.6.0 or later.
Affected software
VendorProductAffected versions
boneio boneio < 1.6.0
Original advisory text
Missing Authentication in Default Configuration in boneIO
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuration, and operating connected physical circuits.
This issue was fixed in version 1.6.0: a device without an administrator account refuses API requests until the owner creates one in the first-run wizard, and every API route is restricted to an authenticated role.

Versions before 1.2.0 are based on Debian 10, are no longer supported and cannot be upgraded in place; affected devices should be re-flashed with the 1.6.0 system image.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published26 Oct 2026
Updated27 Oct 2026
First seen26 Oct 2026
Sources
CVE-2026-77053 · NVD
CVE-2026-77053 · MITRE
CVE-2026-77053 · OSV
Track software like this
Free during beta