5.3
MediumCVSS 4.0 · from CERT-PL
CVE-2026-77061
Missing Authentication for Critical Function in boneIO
boneio · Missing authentication · CWE-306Affectedboneio
FixUpdate to 1.6.0 or newer
PublishedOct 26, 14:46 · CERT-PL
ScoredOct 26 · 5.3 · CERT-PL
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker has to be on the same network. CVSS: adjacent network.
Description
boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and enables targeted attacks against the device. This issue was fixed in version 1.6.0: every API route requires an authenticated role, the interactive API documentation is disabled, and the serial number is withheld from anonymous callers.
From CERT-PL
Affected and fixed versions
ProductAffectedFixed inboneio1.2.0 – before 1.6.01.6.0
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known