boneIO Black: Missing authentication in management web API

Summary

boneIO Black controllers ship with authentication disabled by default. Their management web API listens on all network interfaces and accepts requests for all endpoints without credentials. An unauthenticated attacker who can reach the API, for example from the local network or through a forwarded port, can fully control the device, cause a denial of service, change its configuration and operate connected circuits such as relays, gates and blinds.

Affected

• boneIO Black firmware 1.0.0 to before 1.6.0 (according to the CNA record)
• Devices before 1.2.0 are based on Debian 10 and are no longer supported
• Default configuration: the CNA record states 'default: unaffected'; the exact meaning is unclear and should be checked with the vendor.

Fixed in

• Version 1.6.0: a device without an administrator account refuses API requests until an administrator account is created in the first-run wizard; every API route requires an authenticated role.
• Devices before 1.2.0 cannot be upgraded in place and must be re-flashed with the 1.6.0 system image.

Workaround

• No vendor workaround documented.
• Until patched, restrict access to the web and API ports to a management VLAN or trusted admin hosts, and remove any port forwarding to the device.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof of concept found.

Our recommendation

• Update affected boneIO Black controllers to 1.6.0 or later; re-flash devices before 1.2.0 with the 1.6.0 system image.
• Back up the configuration (/home/boneio/boneio) before updating.
• Restrict network access to the device until it is patched.
• Check whether an administrator account was ever created and review logs for signs of prior access.
• If a device was exposed before patching, rotate the MQTT and web panel passwords.
• A controller that was compromised before the update is not fixed by it.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CERT Polska advisory cert.pl
• boneIO Black documentation boneio.eu
• boneIO app_black 1.6.0 release notes github.com
• CVE record text (CVE-2026-77053) cve.threatint.com
• Strix CVE-2026-77053 www.strix.ai
• OffSeq CVE-2026-77053 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:08.