Live › vulnerability › CVE-2026-77057
Go to dashboardThe boneIO Black device does not limit failed login attempts on its web interface (POST /api/login) or its SSH service, and it does not enforce password complexity. A remote attacker can brute-force passwords without limit and may gain access to the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Teams running boneIO Black devices with the web panel or SSH reachable from a network they do not fully trust are exposed. Devices kept on a private network with no remote access and strong passwords carry much less risk. The sources do not say which versions are affected beyond the fix in 1.6.0.
No product ranges from the sources yet.
1.6.0 and later1.6.0 or later, which rate-limits web logins per source address and per account, requires panel passwords of at least 8 characters, and limits SSH to three authentication attempts per connectionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access to the device.
This issue was fixed in version 1.6.0: web login attempts are rate-limited per source address and per account, panel passwords must be at least 8 characters long, and SSH allows three authentication attempts per connection with a shortened login grace time.
This page as .md · .json · in your agent: get_signal("CVE-2026-77057")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.