CVE-2026-77061
Received Received - Intake

Unauthenticated Information Disclosure in boneIO Black

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: CERT.PL

Description
boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and enables targeted attacks against the device. This issue was fixed in version 1.6.0: every API route requires an authenticated role, the interactive API documentation is disabled, and the serial number is withheld from anonymous callers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-77061
EUVD
EUVD-2026-109956

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
boneIO boneIO 1.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

boneIO Black has several API endpoints that do not require authentication. An unauthenticated attacker on the local network can access sensitive data such as system logs, firmware version, serial number, MQTT username, configuration files, and API documentation. This information can be used to gather intelligence for further attacks on the device.

Detection Guidance

Check for unauthenticated access to API endpoints by attempting to retrieve system logs, firmware version, serial number, MQTT username, or configuration files without authentication. Use network scanning tools to identify boneIO devices and inspect their API responses for exposed data.

Impact Analysis

An attacker could use the exposed data to identify weaknesses in the device, gain unauthorized access, or perform targeted attacks. This may lead to device compromise, data breaches, or disruption of services relying on boneIO Black.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating privacy and security requirements under GDPR and HIPAA. Exposure of logs, configuration files, or device details may result in non-compliance with data protection and security standards.

Mitigation Strategies

Upgrade boneIO firmware to version 1.6.0 or later to enforce authentication on all API routes and disable interactive API documentation. Ensure all API endpoints require authenticated roles and restrict access to sensitive data like serial numbers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77061. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart