Live › vulnerability › CVE-2026-77053
Go to dashboardboneIO Black firmware ships with authentication disabled, and its management web API listens on all network interfaces. An unauthenticated remote attacker can fully control the device, change its configuration, cause denial of service, and operate connected physical circuits.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Any boneIO Black device running firmware before 1.6.0 whose management web API is reachable from the network is exposed, because every API route accepts requests without credentials. Devices behind a network that blocks access to the API port, or devices already updated to with an administrator account created, are not exposed to this flaw. Owners of devices running or later with the fix installed can skip it.
1.6.01.2.0No product ranges from the sources yet.
1.6.0 are affected.1.6.0 or later.1.2.0 are based on Debian 10 and cannot be upgraded in place; re-flash them with the 1.6.0 system image.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuration, and operating connected physical circuits. This issue was fixed in version 1.6.0: a device without an administrator account refuses API requests until the owner creates one in the first-run wizard, and every API route is restricted to an authenticated role.
Versions before 1.2.0 are based on Debian 10, are no longer supported and cannot be upgraded in place; affected devices should be re-flashed with the 1.6.0 system image.
This page as .md · .json · in your agent: get_signal("CVE-2026-77053")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.