Live › vulnerability › CVE-2026-77062
Go to dashboardThe boneIO Black web control panel can be embedded in an iframe on a malicious page. A logged-in user who clicks there can be tricked into switching relays, opening gates or moving blinds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Teams running boneIO Black controllers on a building or site network where staff use the web control panel in a browser. The risk depends on a user with access visiting a malicious site while the panel is open. Systems not running boneIO Black, or running or later, are not affected.
1.6.0No product ranges from the sources yet.
1.6.01.6.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malicious web page and trick an authenticated user on the internal network into clicking buttons that activate relays, open gates, or control blinds. This can lead to unauthorized state changes with potential physical safety consequences. Critically, due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website.
This issue was fixed in version 1.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-77062")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.