Threat reportVulnerabilityTL-2026-4460
Multiple vulnerabilities in boneIO Black and black_debian_images, including unauthenticated Node-RED RCE (CVE-2026-77052 through CVE-2026-77062)
Multiple vulnerabilities in boneIO Black and (TL-2026-4460), also tracked as boneIO Black vulnerabilities, is a high-severity software vulnerability scored CVSS 8.7, first published 2026-10-26. It has no confirmed attribution, affects boneIO boneIO (app_black, boneIO Black web UI/API), references 11 CVEs (CVE-2026-77052, CVE-2026-77053, CVE-2026-77054), maps to 10 MITRE ATT&CK techniques (T1059.004, T1078.001, T1082), and is covered by 9 detection rules and 14 indicators of compromise.
- CVSS
- 8.7/10High
- CVEs
- 11Referenced vulnerabilities
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-4460
- Threat ID
- TL-2026-4460
- Also known as
- boneIO Black vulnerabilities, black_debian_images vulnerabilities
- Severity
- HIGH
- CVSS
- 8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- smart-home, building-automation, residential
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Multiple vulnerabilities in boneIO Black and
Malware and tooling: Caddy, Mosquitto, Node-RED
How Multiple vulnerabilities in boneIO Black and works
CERT Polska disclosed 11 vulnerabilities on 2026-10-26 in the boneIO Black DIN-rail home-automation controller (boneIO app) and its black_debian_images firmware. The flaws include an unauthenticated Node-RED instance enabling remote code execution, authentication disabled by default, cleartext credentials, shared default MQTT credentials and passwordless sudo/docker privileges. All are fixed in version 1.6.0.
CERT Polska (CVD coordinator) published an advisory on 2026-10-26, credited to Mateusz Włodarczak (s3ga), covering eleven CVEs in boneIO Black, a DIN-rail home-automation controller running Debian with Caddy, Mosquitto (MQTT), Node-RED and Home Assistant integration. The web UI is served at https://<controller IP>:8443. NVD records were published the same day with CVSS v4.0 scores.
Remote / adjacent-network attack surface: CVE-2026-77052 (CWE-306, CVSS 4.0 8.7 HIGH) exposes an unauthenticated Node-RED instance at /nodered/ behind a Caddy reverse proxy; the Node-RED Admin API allows deploying flows that run arbitrary system commands, giving unauthenticated attackers on the local network remote code execution (affected 1.3.0 up to 1.6.0). CVE-2026-77053 (CWE-306, 8.7 HIGH) ships with authentication disabled by default and an API listening on all interfaces, allowing full device control including operating connected physical circuits (relays, blinds, gates). CVE-2026-77061 (CWE-306, 5.3 MEDIUM) leaves several API endpoints unauthenticated, leaking system logs, firmware version, serial number, MQTT username, configuration file listings and API documentation. CVE-2026-77054 (CWE-312, 6.9 MEDIUM) stores passwords in cleartext and returns the full configuration, including sub-service passwords, from GET /api/config; combined with CVE-2026-77053 an unauthenticated adjacent attacker can harvest all passwords. CVE-2026-77056 (CWE-1392, 7.1 HIGH) ships the Mosquitto MQTT broker with the same publicly documented default credentials on all devices, giving full read/write on the broker, control of relays, blinds and gates, and the ability to inject fake entities into a linked Home Assistant. CVE-2026-77057 (CWE-307, 2.3 LOW) has no rate limiting on web login or SSH and no password complexity enforcement. CVE-2026-77058 (CWE-352, 5.1 MEDIUM) lacks CSRF tokens and Origin/Referer validation, allowing a malicious page visited by an internal user to reboot the controller, switch relays, operate gates and blinds, or terminate the device; the default-disabled authentication amplifies the risk. CVE-2026-77062 (CWE-1021) lacks clickjacking protections (frame/iframe restrictions); an NVD score could not be retrieved at research time.
Local privilege-escalation surface: CVE-2026-77055 (CWE-266, 9.3 CRITICAL, local) gives the boneio service account full passwordless sudo and docker group membership, so a compromised boneio account (for example via the Node-RED RCE) becomes root. CVE-2026-77059 (CWE-367, 8.8 HIGH, local) is a TOCTOU race in create_timedatectl_sudoers_file() in boneio/webui/routes/timezone_sudoers.py that allows sudoers rule injection via content substitution or symlink attacks on a predictable filename, leading to root. CVE-2026-77060 (CWE-732, 6.8 MEDIUM, local) leaves /etc/mosquitto/passwd world-readable so any local user can read MQTT password hashes and mount offline dictionary attacks.
Chaining the adjacent-network flaws (77053 / 77052 / 77054) with the local ones (77055 / 77059) yields unauthenticated network-adjacent root on the controller, a pivot point into the building network and Home Assistant. Remediation in 1.6.0: enforced admin account creation and role-based access control, authentication on all routes with API docs disabled, salted scrypt password hashes with secrets no longer returned by the API, per-device generated MQTT passwords at first boot, removal of the sudoers rules and docker group membership with privileged operations via restricted helpers verifying Ed25519 signatures, web-login rate limiting per source and account, 8-character minimum password and SSH limited to three attempts per connection. Devices below 1.2.0 require re-flashing rather than in-place upgrade.
Source caveats: the CERT Polska page lists 1.6.0 both as fixed and within the affected range; NVD states affected versions are prior to 1.6.0, which this record follows. NVD labels CWE-307 for CVE-2026-77057 with a different title (UI layer restriction); CERT Polska's CWE-307 (excessive authentication attempts) matches the described behavior and is used. The sources do not state a public PoC, in-the-wild exploitation, CISA KEV listing, threat actor or network IOCs. CVE-2026-77052 / CVE-2026-77053 are the headline scores; the record's CVSS is the 4.0 score and vector from the NVD entry for CVE-2026-77053.
MITRE ATT&CK techniques used in TL-2026-4460
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell
Initial Access
T1078.001 Valid Accounts: Default Accounts; T1190 Exploit Public-Facing Application
Discovery
T1082 System Information Discovery
Credential Access
T1110.001 Brute Force: Password Guessing; T1110.002 Brute Force: Password Cracking; T1552.001 Unsecured Credentials: Credentials In Files
Impact
Privilege Escalation
T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching; T1611 Escape to Host
Affected products and versions in Multiple vulnerabilities in boneIO Black and
- boneIO — boneIO (app_black, boneIO Black web UI/API)
Vulnerable versions: 1.0.0 to before 1.6.0 (CVE-2026-77053); 1.2.0 to before 1.6.0 (CVE-2026-77054, 77057, 77058, 77061, 77062); 1.3.0 to before 1.6.0 (CVE-2026-77052, 77059)
Fixed in: 1.6.0 - boneIO — black_debian_images
Vulnerable versions: 1.2.0 to before 1.6.0 (CVE-2026-77055, 77056, 77060)
Fixed in: 1.6.0
Remediation for Multiple vulnerabilities in boneIO Black and
Patches
- boneIO 1.6.0 (CERT Polska advisory, NVD CVE-2026-77052 to CVE-2026-77062)
Immediate actions
- Upgrade boneIO Black / black_debian_images to version 1.6.0 or later (devices below 1.2.0 must be re-flashed)
- Complete first-run administrator account setup so authentication is enforced on all API routes
- Rotate all MQTT, web panel and SSH passwords and any credentials previously returned by /api/config
- Restrict access to the controller (https port 8443, /nodered/, MQTT 1883) to a dedicated management VLAN
Workarounds
- Do not expose the controller to untrusted networks while authentication is disabled
- Block /nodered/ at a reverse proxy or firewall until upgraded
- Do not browse untrusted sites from hosts on the same network as an unpatched controller (CSRF/clickjacking)
Longer-term hardening
- Isolate building-automation controllers from user and internet-facing networks
- Monitor MQTT broker and Home Assistant for unexpected publishers or injected entities
- Alert on new sudoers.d files and docker group changes on controllers
CVEs associated with Multiple vulnerabilities in boneIO Black and
CVE-2026-77052, CVE-2026-77053, CVE-2026-77054, CVE-2026-77055, CVE-2026-77056, CVE-2026-77057, CVE-2026-77058, CVE-2026-77059, CVE-2026-77060, CVE-2026-77061, CVE-2026-77062
Weaknesses (CWE) in Multiple vulnerabilities in boneIO Black and
CWE-306, CWE-312, CWE-266, CWE-1392, CWE-307, CWE-352, CWE-367, CWE-732, CWE-1021
Timeline of Multiple vulnerabilities in boneIO Black and
- Advisory and NVD records state no public PoC and no in-the-wild exploitation; no KEV listing identified
- Local privilege-escalation flaws CVE-2026-77055 (9.3 CRITICAL) and CVE-2026-77059 (8.8 HIGH) rated; chaining with the network RCE gives root on the controller
- CVE-2026-77052 (unauthenticated Node-RED /nodered/ RCE) and CVE-2026-77053 (authentication disabled by default) rated CVSS 4.0 8.7 HIGH, adjacent-network attack vector
- boneIO 1.6.0 identified as the fixed version: enforced admin setup and RBAC, scrypt password hashing, per-device MQTT passwords, removal of passwordless sudo/docker membership, login rate limiting
- NVD published records for the CVEs with CVSS v4.0 scores ranging from 2.3 (CVE-2026-77057) to 9.3 (CVE-2026-77055)
- CERT Polska published a coordinated-disclosure advisory covering 11 vulnerabilities (CVE-2026-77052 to CVE-2026-77062) in boneIO and black_debian_images, credited to Mateusz Włodarczak (s3ga)
Sources cited for Multiple vulnerabilities in boneIO Black and
Detection coverage for TL-2026-4460
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4460 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.