{"id":"CVE-2026-77062","kind":"vulnerability","aliases":["CVE-2026-77062"],"related":[],"title":"boneIO Black: web panel can be framed, enabling clickjacked relay actions","description":"The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malicious web page and trick an authenticated user on the internal network into clicking buttons that activate relays, open gates, or control blinds. This can lead to unauthorized state changes with potential physical safety consequences. Critically, due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website.\n\nThis issue was fixed in version 1.6.0.","summary":"The boneIO Black web control panel can be embedded in an iframe on a malicious page. A logged-in user who clicks there can be tricked into switching relays, opening gates or moving blinds.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["boneio","home-automation","infrastructure","iot","self-hosted"],"not_affected_if":["panel-unreachable-from-users-browsers","version-1.6.0-or-later"],"how_to_check":"- Check the installed boneIO version; the sources say the fix is in `1.6.0`\n- Check whether the control panel's login is enabled, since CVE-2026-77053 says authentication is disabled by default","fix":"- Upgrade boneIO Black to `1.6.0` or later\n- Disable authentication only if you accept the risk from CVE-2026-77053; re-enable it on the panel","status":"open","published_at":"2026-10-26T15:16:44+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:03:42+00:00","updated_at":"2026-10-26T16:03:42+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-26T16:03:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade boneIO Black to `1.6.0` or later\n- Disable authentication only if you accept the risk from CVE-2026-77053; re-enable it on the panel","reach":"network","title":"boneIO Black: web panel can be framed, enabling clickjacked relay actions","impact":"medium","summary":"The boneIO Black web control panel can be embedded in an iframe on a malicious page. A logged-in user who clicks there can be tricked into switching relays, opening gates or moving blinds.","category":"infrastructure","nicknames":[],"who_cares":["boneio","home-automation","iot","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Unauthorized relay, gate or blind changes triggered by clicks on a malicious page","analyst_note":"","how_to_check":"- Check the installed boneIO version; the sources say the fix is in `1.6.0`\n- Check whether the control panel's login is enabled, since CVE-2026-77053 says authentication is disabled by default","needs_analyst":false,"not_affected_if":["version-1.6.0-or-later","panel-unreachable-from-users-browsers"],"who_is_affected":"Teams running boneIO Black controllers on a building or site network where staff use the web control panel in a browser. The risk depends on a user with access visiting a malicious site while the panel is open. Systems not running boneIO Black, or running `1.6.0` or later, are not affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000608,"input_tokens":3385,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A,123C '-77053':124C '-77062':14A,17A '1.6.0':153C 'action':11A,141C 'activ':100C 'attack':73C,139C 'attacker-control':138C 'authent':90C,125C 'autom':21B 'black':2A,29B,64C 'blind':61B,106C 'boneio':1A,18B,28B,63C 'button':98C 'chang':113C 'click':49B,97C 'clickjack':9A,69C 'consequ':118C 'control':31B,77C,105C,140C 'critic':119C 'cve':12A,15A,122C 'default':128C 'disabl':126C 'due':120C 'emb':75C 'embed':35B 'enabl':8A 'fix':150C 'frame':7A 'gate':58B,103C 'home':20B 'home-autom':19B 'host':26B 'ifram':38B,81C 'infrastructur':22B 'interfac':66C 'intern':94C,134C 'iot':23B 'issu':148C 'lack':67C 'lead':109C 'log':45B 'logged-in':44B 'malici':41B,84C,145C 'move':60B 'network':95C,135C 'open':57B,102C 'page':42B,86C 'panel':4A,32B,78C 'physic':116C 'potenti':115C 'proper':68C 'protect':70C 'relay':10A,56B,101C 'remot':72C 'safeti':117C 'self':25B 'self-host':24B 'state':112C 'switch':55B 'trick':53B,88C 'trigger':137C 'unauthor':111C 'user':47B,91C,130C 'version':152C 'visit':143C 'web':3A,30B,65C,85C 'websit':146C","nicknames":[],"mitigations":[],"who_affected":"Teams running boneIO Black controllers on a building or site network where staff use the web control panel in a browser. The risk depends on a user with access visiting a malicious site while the panel is open. Systems not running boneIO Black, or running `1.6.0` or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77062","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77062","severity":null,"published_at":"2026-10-26T15:16:44+00:00","modified_at":"2026-10-26T15:16:44+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}