CVE-2026-77052
Received Received - Intake

Unauthenticated RCE via Node-RED in boneIO Black

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: CERT.PL

Description
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system. This issue was fixed in version 1.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-77052
EUVD
EUVD-2026-109947

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
boneIO boneIO 1.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.

Detection Guidance
  • Check if the /nodered/ path is accessible on your boneIO Black device by accessing http://<device-ip>/nodered/ in a web browser or using curl: curl http://<device-ip>/nodered/
  • Verify the installed version of boneIO Black. If it is below 1.6.0, the system is vulnerable: curl http://<device-ip>/ or check the web interface.
Impact Analysis

An attacker could gain full control over your home automation system, allowing them to execute arbitrary commands on the device. This could lead to unauthorized access to connected devices, data theft, or disruption of home automation functions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data processed by the home automation system, potentially violating GDPR or HIPAA if sensitive information is exposed. Compliance may be impacted due to lack of proper access controls and authentication.

Mitigation Strategies
  • Upgrade boneIO Black to version 1.6.0 or later immediately to patch the vulnerability.
  • Restrict network access to the /nodered/ path by configuring firewall rules to allow only trusted IPs.
  • Disable the Node-RED Admin API if not required or restrict access to authenticated users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77052. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart