CVE-2026-77062: Clickjacking in boneIO

Q: Are default deployments exposed to unauthenticated users on the internal network?

Yes. Authentication is disabled by default because of CVE-2026-77053, so any user on the same internal network can trigger attacker-controlled actions by visiting a malicious website.

Q: What does an attacker need to exploit this issue?

The attacker needs to host a malicious page that embeds the boneIO Black control panel in an iframe and induce a user who can access the interface to visit it. When authentication remains disabled by default, a user on the internal network can be used to trigger the actions without prior authentication.

Q: Which version addresses the issue?

The issue was fixed in version 1.6.0.

Published Oct 26, 2026

Updated

The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malicious web page and trick an authenticated user on the internal network into clicking buttons that activate relays, open gates, or control blinds. This can lead to unauthorized state changes with potential physical safety consequences. Critically, due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website.

This issue was fixed in version 1.6.0.

Affected Software

1 affected component

boneIO boneIO Black<1.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade boneIO to a version that resolves this vulnerability.
Fixed in 1.6.0

Event History

Oct 26, 2026

CVE Published

via MITRE·02:46 PM

Data Sourced

via MITRE·02:46 PM

DescriptionWeakness

Frequently Asked Questions

Are default deployments exposed to unauthenticated users on the internal network?

Yes. Authentication is disabled by default because of CVE-2026-77053, so any user on the same internal network can trigger attacker-controlled actions by visiting a malicious website.

What does an attacker need to exploit this issue?

The attacker needs to host a malicious page that embeds the boneIO Black control panel in an iframe and induce a user who can access the interface to visit it. When authentication remains disabled by default, a user on the internal network can be used to trigger the actions without prior authentication.

Which version addresses the issue?

The issue was fixed in version 1.6.0.

CVE-2026-77062: Clickjacking in boneIO

Affected Software

Remediation

Event History

Frequently Asked Questions

Are default deployments exposed to unauthenticated users on the internal network?

What does an attacker need to exploit this issue?

Which version addresses the issue?

Company

Resources

Contact

Frequently Asked Questions

Are default deployments exposed to unauthenticated users on the internal network?

What does an attacker need to exploit this issue?

Which version addresses the issue?