Live › vulnerability › CVE-2026-77061
Go to dashboardboneIO Black exposes several API endpoints without authentication. A remote attacker on the local network can read system logs, firmware version, serial number, MQTT username, configuration file listings and API docs, which helps plan targeted attacks against the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Owners of boneIO Black devices on a network where untrusted hosts can reach the device's API. The sources do not name a specific configuration that is required, so any reachable boneIO Black below 1.6.0 should be treated as affected. Devices isolated from the local network are less exposed.
No product ranges from the sources yet.
1.6.0 are affected.1.6.0 or later, which requires authentication on every API route and disables the interactive API docs.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and enables targeted attacks against the device. This issue was fixed in version 1.6.0: every API route requires an authenticated role, the interactive API documentation is disabled, and the serial number is withheld from anonymous callers.
This page as .md · .json · in your agent: get_signal("CVE-2026-77061")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.