CVE-2026-77056
Received Received - Intake

Default MQTT Credentials in boneIO Black Debian Images

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: CERT.PL

Description
boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation. This issue was fixed in version 1.6.0 of the image: MQTT passwords are generated per device at first boot. Devices upgraded from earlier versions keep their existing broker credentials; from boneio 1.6.0 the web panel reports credentials that are still the published defaults, and the owner has to change them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-77056
EUVD
EUVD-2026-109951

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
boneIO black_debian_images 1.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1392 The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves boneIO black_debian_images shipping with a Mosquitto MQTT broker that uses default credentials shared across all devices. These credentials are publicly documented online, allowing remote attackers to gain full access to the broker. This could let them control connected devices like relays, blinds, and gates, and inject fake entities into a Home Assistant setup.

Detection Guidance

Check if your boneIO device is using default Mosquitto MQTT credentials by inspecting the MQTT broker configuration. Look for hardcoded credentials in the broker setup or web panel. Verify if the credentials match those publicly documented online.

Impact Analysis

An attacker could exploit this to take control of your IoT devices, manipulate their operations, or introduce unauthorized entities into your Home Assistant system. This could lead to physical security risks or unauthorized access to your smart home environment.

Mitigation Strategies

Upgrade to boneIO version 1.6.0 or later where MQTT passwords are generated per device at first boot. If upgrading from an earlier version, manually change the default MQTT credentials in the web panel to unique, strong passwords.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77056. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart