{"id":"CVE-2026-77057","kind":"vulnerability","aliases":["CVE-2026-77057"],"related":[],"title":"boneIO Black: unlimited login attempts allow brute-forcing web panel and SSH","description":"boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access to the device.\n\nThis issue was fixed in version 1.6.0: web login attempts are rate-limited per source address and per account, panel passwords must be at least 8 characters long, and SSH allows three authentication attempts per connection with a shortened login grace time.","summary":"The boneIO Black device does not limit failed login attempts on its web interface (POST /api/login) or its SSH service, and it does not enforce password complexity. A remote attacker can brute-force passwords without limit and may gain access to the device.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["boneio","home-automation","infrastructure","iot","self-hosted"],"not_affected_if":["private-network-only","strong-password"],"how_to_check":"- Check the installed boneIO Black version; the fix is in `1.6.0` and later\n- Review the panel password for length; passwords shorter than 8 characters are weak under the fixed policy\n- unknown whether other checks are available from the sources","fix":"- Upgrade boneIO Black to `1.6.0` or later, which rate-limits web logins per source address and per account, requires panel passwords of at least 8 characters, and limits SSH to three authentication attempts per connection\n- Change any panel or SSH password that is short or reused after upgrading","status":"open","published_at":"2026-10-26T15:16:43+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:04:00+00:00","updated_at":"2026-10-26T16:04:00+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T16:04:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade boneIO Black to `1.6.0` or later, which rate-limits web logins per source address and per account, requires panel passwords of at least 8 characters, and limits SSH to three authentication attempts per connection\n- Change any panel or SSH password that is short or reused after upgrading","reach":"network","title":"boneIO Black: unlimited login attempts allow brute-forcing web panel and SSH","impact":"high","summary":"The boneIO Black device does not limit failed login attempts on its web interface (POST /api/login) or its SSH service, and it does not enforce password complexity. A remote attacker can brute-force passwords without limit and may gain access to the device.","category":"infrastructure","nicknames":[],"who_cares":["boneio","self-hosted","iot","home-automation"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker guesses a password and gets access to the device","analyst_note":"","how_to_check":"- Check the installed boneIO Black version; the fix is in `1.6.0` and later\n- Review the panel password for length; passwords shorter than 8 characters are weak under the fixed policy\n- unknown whether other checks are available from the sources","needs_analyst":false,"not_affected_if":["private-network-only","strong-password"],"who_is_affected":"Teams running boneIO Black devices with the web panel or SSH reachable from a network they do not fully trust are exposed. Devices kept on a private network with no remote access and strong passwords carry much less risk. The sources do not say which versions are affected beyond the fix in 1.6.0.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000627,"input_tokens":3391,"output_tokens":575,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-77057':16A,19A '/api/login':44B,85C '1.6.0':124C '8':144C 'access':69B,114C 'account':110C,137C 'address':134C 'allow':6A,149C 'attack':58B,98C 'attempt':5A,38B,79C,106C,127C,152C 'authent':78C,151C 'autom':23B 'black':2A,31B,74C 'boneio':1A,20B,30B,73C 'brute':8A,61B,103C 'brute-forc':7A,60B,102C 'charact':145C 'complex':55B,94C 'compromis':108C 'connect':154C 'cve':14A,17A 'devic':32B,72B,117C 'enforc':53B,92C 'fail':36B 'fix':121C 'forc':9A,62B,104C 'gain':68B,112C 'grace':159C 'home':22B 'home-autom':21B 'host':28B 'infrastructur':24B 'interfac':42B,83C 'iot':25B 'issu':119C 'least':143C 'limit':35B,65B,77C,131C 'login':4A,37B,105C,126C,158C 'long':146C 'make':100C 'may':67B 'must':140C 'panel':11A,138C 'password':54B,63B,93C,139C 'per':132C,136C,153C 'post':43B,84C 'potenti':107C 'rate':130C 'rate-limit':129C 'remot':57B,97C 'self':27B 'self-host':26B 'servic':48B,88C 'shorten':157C 'sourc':133C 'ssh':13A,47B,87C,148C 'three':150C 'time':160C 'unauthent':96C 'unauthor':113C 'unlimit':3A,101C 'user':109C 'version':123C 'web':10A,41B,82C,125C 'without':64B","nicknames":[],"mitigations":[],"who_affected":"Teams running boneIO Black devices with the web panel or SSH reachable from a network they do not fully trust are exposed. Devices kept on a private network with no remote access and strong passwords carry much less risk. The sources do not say which versions are affected beyond the fix in 1.6.0.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77057","severity":null,"published_at":"2026-10-26T15:16:43+00:00","modified_at":"2026-10-26T15:16:43+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}