CVE-2026-77060: Incorrect Permission Assignment for Critical Resource in boneIO

Q: Who can exploit this issue?

Any local user on an affected system can read /etc/mosquitto/passwd. They can obtain password hashes for all MQTT accounts and attempt offline dictionary attacks without needing direct MQTT access.

Q: Which versions are affected?

The issue was fixed in boneIO black_debian_images version 1.6.0. Systems not yet updated to that version may be affected based on the provided information.

Q: How can I determine whether a system is exposed?

Check the permissions on /etc/mosquitto/passwd. A system is exposed if the file is readable by all local users.

Q: What can be done before upgrading?

Restrict read access to /etc/mosquitto/passwd so that unprivileged local users cannot read it. Because hashes may already have been exposed, consider changing MQTT account passwords after correcting the permissions.

Published Oct 26, 2026

Updated

boneIO blackdebianimages stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks.

This issue was fixed in version 1.6.0.

Affected Software

1 affected component

boneIO black_debian_images<1.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade boneIO black_debian_images to a version that resolves this vulnerability.
Fixed in 1.6.0

Event History

Oct 26, 2026

CVE Published

via MITRE·02:46 PM

Data Sourced

via MITRE·02:46 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any local user on an affected system can read /etc/mosquitto/passwd. They can obtain password hashes for all MQTT accounts and attempt offline dictionary attacks without needing direct MQTT access.

Which versions are affected?

The issue was fixed in boneIO black_debian_images version 1.6.0. Systems not yet updated to that version may be affected based on the provided information.

How can I determine whether a system is exposed?

Check the permissions on /etc/mosquitto/passwd. A system is exposed if the file is readable by all local users.

What can be done before upgrading?

Restrict read access to /etc/mosquitto/passwd so that unprivileged local users cannot read it. Because hashes may already have been exposed, consider changing MQTT account passwords after correcting the permissions.

CVE-2026-77060: Incorrect Permission Assignment for Critical Resource in boneIO

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which versions are affected?

How can I determine whether a system is exposed?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which versions are affected?

How can I determine whether a system is exposed?

What can be done before upgrading?