CVE-2026-77053: Missing Authentication in Default Configuration in boneIO

Q: Which devices are exposed to unauthenticated remote control?

boneIO Black devices running firmware with authentication disabled are exposed because the management web API listens on all network interfaces and does not require credentials. An attacker able to reach that API can control the device, change its configuration, cause denial of service, and operate connected physical circuits.

Q: What changes in version 1.6.0 prevent exploitation?

Version 1.6.0 refuses API requests on devices that do not yet have an administrator account, until the owner creates one through the first-run wizard. It also restricts every API route to an authenticated role.

Q: What should be done for devices running versions before 1.2.0?

These versions are based on unsupported Debian 10 and cannot be upgraded in place. The affected device should be re-flashed using the 1.6.0 system image.

Published Oct 26, 2026

Updated

boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuration, and operating connected physical circuits. This issue was fixed in version 1.6.0: a device without an administrator account refuses API requests until the owner creates one in the first-run wizard, and every API route is restricted to an authenticated role.

Versions before 1.2.0 are based on Debian 10, are no longer supported and cannot be upgraded in place; affected devices should be re-flashed with the 1.6.0 system image.

Affected Software

1 affected component

boneIO Black firmware<1.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade boneIO to a version that resolves this vulnerability.
Fixed in 1.6.0
Configuration
Create an administrator account in the first-run wizard so API requests require authentication.
boneIO management web API administrator account = created

Event History

Oct 26, 2026

CVE Published

via MITRE·02:45 PM

Data Sourced

via MITRE·02:45 PM

DescriptionWeakness

Frequently Asked Questions

Which devices are exposed to unauthenticated remote control?

boneIO Black devices running firmware with authentication disabled are exposed because the management web API listens on all network interfaces and does not require credentials. An attacker able to reach that API can control the device, change its configuration, cause denial of service, and operate connected physical circuits.

What changes in version 1.6.0 prevent exploitation?

Version 1.6.0 refuses API requests on devices that do not yet have an administrator account, until the owner creates one through the first-run wizard. It also restricts every API route to an authenticated role.

What should be done for devices running versions before 1.2.0?

These versions are based on unsupported Debian 10 and cannot be upgraded in place. The affected device should be re-flashed using the 1.6.0 system image.

CVE-2026-77053: Missing Authentication in Default Configuration in boneIO

Affected Software

Remediation

Event History

Frequently Asked Questions

Which devices are exposed to unauthenticated remote control?

What changes in version 1.6.0 prevent exploitation?

What should be done for devices running versions before 1.2.0?

Company

Resources

Contact

Frequently Asked Questions

Which devices are exposed to unauthenticated remote control?

What changes in version 1.6.0 prevent exploitation?

What should be done for devices running versions before 1.2.0?