CVE-2026-77058
Received Received - Intake

Cross-Site Request Forgery in boneIO Black Controller

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: CERT.PL

Description
boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin requests to the device. This allows the attacker to reboot the controller, toggle relay circuits, control gates and blinds, or shut down the device, causing loss of integrity and availability. Critically, due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website. This issue was fixed in version 1.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-77058
EUVD
EUVD-2026-109953

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
boneIO boneIO 1.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that sends cross-origin requests to the device when visited by a user on the internal network.

Detection Guidance

Detecting this CSRF vulnerability requires checking if boneIO Black devices are running versions prior to 1.6.0 and if state-changing API endpoints lack CSRF tokens or Origin/Referer header validation. Inspect network traffic for unauthorized API requests from internal sources. Use tools like curl to test endpoints for missing CSRF protections.

Impact Analysis

An attacker can reboot the controller, toggle relay circuits, control gates and blinds, or shut down the device, causing loss of integrity and availability. If CVE-2026-77053 is present (authentication disabled by default), any user on the same internal network can trigger these actions by visiting a malicious website.

Compliance Impact

This vulnerability could lead to unauthorized control of devices, potentially violating integrity and availability requirements in GDPR and HIPAA. Loss of device control may result in non-compliance with data protection and security standards.

Mitigation Strategies

Immediately upgrade boneIO Black to version 1.6.0 or later to address the CSRF vulnerability. Ensure authentication is enabled by default to mitigate CVE-2026-77053. Restrict network access to the device and monitor for suspicious API activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77058. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart