boneIO Black: Missing authentication for Node-RED enables remote code execution
Summary
The boneIO Black home automation controller exposes a Node-RED instance at the /nodered/ path through a Caddy reverse proxy without authentication. An attacker with access to the local network can deploy a malicious flow through the Node-RED Admin API and execute arbitrary system commands. Successful exploitation gives full control over the home automation system.
Affected
- boneIO Black versions 1.3.0 up to but not including 1.6.0
- Versions before 1.2.0 are based on Debian 10, are no longer supported and cannot be upgraded in place
Fixed in
- Fixed in version 1.6.0
Workaround
- Restrict or disable the Node-RED Admin API in its settings file, or use a firewall so that only trusted hosts can send flow deployments
- Keep the controller off shared or guest network segments and do not expose its web port to the internet
- Change the default MQTT and web panel passwords
Exploitation
- Not known to be exploited in the wild (OffSeq; not listed in CISA KEV per Strix)
- No public proof of concept found in the research; this does not prove that none exists
- VulDB lists the status as 0-Day
Our recommendation
- Update all boneIO Black controllers to version 1.6.0 or later
- Check whether the controller is reachable from untrusted networks, including through the Caddy configuration, port forwards or remote-access tools
- Change the MQTT broker and web panel passwords after the upgrade, as devices keep existing credentials
- Review the Node-RED configuration and monitor for unexpected flow deployments
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska advisory CVE-2026-77052 cert.pl
- boneIO Black documentation boneio.eu
- OpenCVE CVE-2026-77052 app.opencve.io
- VulDB entry 426470 vuldb.com
- OffSeq patch and exploitation status radar.offseq.com
- Strix CVE-2026-77052 www.strix.ai
- Pre-release notes v1.6.0.dev35 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:07.
Original description (NVD)
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system. This issue was fixed in version 1.6.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.