Live › vulnerability › CVE-2026-77056
Go to dashboardThe boneIO black_debian_images build runs a Mosquitto MQTT broker with the same default username and password on every device, and those credentials are published on GitHub. A remote attacker who logs in can read and write all broker topics, switching connected relays, blinds and gates and injecting fake entities into a linked Home Assistant.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Teams running boneIO on BeagleBone-based boards built from the black_debian_images image that expose the Mosquitto broker to a network they do not fully control. Devices on an isolated network with no remote access are at lower risk, and devices already on 1.6.0 or later with regenerated credentials are not affected by the default-credential issue.
No product ranges from the sources yet.
1.6.0, since upgraded devices keep their old broker credentials.1.6.0 or later, which generates per-device MQTT passwords at first boot.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation.
This issue was fixed in version 1.6.0 of the image: MQTT passwords are generated per device at first boot. Devices upgraded from earlier versions keep their existing broker credentials; from boneio 1.6.0 the web panel reports credentials that are still the published defaults, and the owner has to change them.
This page as .md · .json · in your agent: get_signal("CVE-2026-77056")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.