CVE-2026-77062
Received Received - Intake

Clickjacking Vulnerability in boneIO Black Web Interface

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: CERT.PL

Description
The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malicious web page and trick an authenticated user on the internal network into clicking buttons that activate relays, open gates, or control blinds. This can lead to unauthorized state changes with potential physical safety consequences. Critically, due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website. This issue was fixed in version 1.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-77062
EUVD
EUVD-2026-109958

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
boneIO boneIO 1.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1021 The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The boneIO Black web interface is vulnerable to clickjacking due to missing protections. An attacker can embed the control panel in an iframe on a malicious site and trick authenticated users into clicking buttons that trigger unauthorized actions like controlling relays, gates, or blinds. This can lead to physical safety risks.

Detection Guidance

Check if the boneIO Black web interface version is below 1.6.0 by inspecting the system or logs. Look for iframe embedding attempts in network traffic or browser console logs that may indicate clickjacking attempts.

Impact Analysis

If you use boneIO Black on your internal network, an attacker could trick you or others into changing device states (e.g., opening gates) by visiting a malicious website. This is worse if CVE-2026-77053 is present, as no authentication is needed for network users to trigger actions.

Mitigation Strategies

Upgrade the boneIO Black web interface to version 1.6.0 or later to address the clickjacking vulnerability. Ensure authentication is enabled and properly configured to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77062. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart