# Multiple vulnerabilities in boneIO Black and black_debian_images, including unauthenticated Node-RED RCE (CVE-2026-77052 through CVE-2026-77062)

> CERT Polska disclosed 11 vulnerabilities on 2026-10-26 in the boneIO Black DIN-rail home-automation controller (boneIO app) and its black_debian_images firmware. The flaws include an unauthenticated Node-RED instance enabling remote code execution, authentication disabled by default, cleartext credentials, shared default MQTT credentials and passwordless sudo/docker privileges. All are fixed in version 1.6.0.

- **Published:** 2026-10-26T15:49:36Z
- **Last reviewed:** 2026-10-26T15:49:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4460
- **ID:** TL-2026-4460
- **Severity:** HIGH (CVSS 8.7)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-77052, CVE-2026-77053, CVE-2026-77054, CVE-2026-77055, CVE-2026-77056, CVE-2026-77057, CVE-2026-77058, CVE-2026-77059, CVE-2026-77060, CVE-2026-77061, CVE-2026-77062

## Description

CERT Polska (CVD coordinator) published an advisory on 2026-10-26, credited to Mateusz Włodarczak (s3ga), covering eleven CVEs in boneIO Black, a DIN-rail home-automation controller running Debian with Caddy, Mosquitto (MQTT), Node-RED and Home Assistant integration. The web UI is served at https://<controller IP>:8443. NVD records were published the same day with CVSS v4.0 scores.

Remote / adjacent-network attack surface: CVE-2026-77052 (CWE-306, CVSS 4.0 8.7 HIGH) exposes an unauthenticated Node-RED instance at /nodered/ behind a Caddy reverse proxy; the Node-RED Admin API allows deploying flows that run arbitrary system commands, giving unauthenticated attackers on the local network remote code execution (affected 1.3.0 up to 1.6.0). CVE-2026-77053 (CWE-306, 8.7 HIGH) ships with authentication disabled by default and an API listening on all interfaces, allowing full device control including operating connected physical circuits (relays, blinds, gates). CVE-2026-77061 (CWE-306, 5.3 MEDIUM) leaves several API endpoints unauthenticated, leaking system logs, firmware version, serial number, MQTT username, configuration file listings and API documentation. CVE-2026-77054 (CWE-312, 6.9 MEDIUM) stores passwords in cleartext and returns the full configuration, including sub-service passwords, from GET /api/config; combined with CVE-2026-77053 an unauthenticated adjacent attacker can harvest all passwords. CVE-2026-77056 (CWE-1392, 7.1 HIGH) ships the Mosquitto MQTT broker with the same publicly documented default credentials on all devices, giving full read/write on the broker, control of relays, blinds and gates, and the ability to inject fake entities into a linked Home Assistant. CVE-2026-77057 (CWE-307, 2.3 LOW) has no rate limiting on web login or SSH and no password complexity enforcement. CVE-2026-77058 (CWE-352, 5.1 MEDIUM) lacks CSRF tokens and Origin/Referer validation, allowing a malicious page visited by an internal user to reboot the controller, switch relays, operate gates and blinds, or terminate the device; the default-disabled authentication amplifies the risk. CVE-2026-77062 (CWE-1021) lacks clickjacking protections (frame/iframe restrictions); an NVD score could not be retrieved at research time.

Local privilege-escalation surface: CVE-2026-77055 (CWE-266, 9.3 CRITICAL, local) gives the boneio service account full passwordless sudo and docker group membership, so a compromised boneio account (for example via the Node-RED RCE) becomes root. CVE-2026-77059 (CWE-367, 8.8 HIGH, local) is a TOCTOU race in create_timedatectl_sudoers_file() in boneio/webui/routes/timezone_sudoers.py that allows sudoers rule injection via content substitution or symlink attacks on a predictable filename, leading to root. CVE-2026-77060 (CWE-732, 6.8 MEDIUM, local) leaves /etc/mosquitto/passwd world-readable so any local user can read MQTT password hashes and mount offline dictionary attacks.

Chaining the adjacent-network flaws (77053 / 77052 / 77054) with the local ones (77055 / 77059) yields unauthenticated network-adjacent root on the controller, a pivot point into the building network and Home Assistant. Remediation in 1.6.0: enforced admin account creation and role-based access control, authentication on all routes with API docs disabled, salted scrypt password hashes with secrets no longer returned by the API, per-device generated MQTT passwords at first boot, removal of the sudoers rules and docker group membership with privileged operations via restricted helpers verifying Ed25519 signatures, web-login rate limiting per source and account, 8-character minimum password and SSH limited to three attempts per connection. Devices below 1.2.0 require re-flashing rather than in-place upgrade.

Source caveats: the CERT Polska page lists 1.6.0 both as fixed and within the affected range; NVD states affected versions are prior to 1.6.0, which this record follows. NVD labels CWE-307 for CVE-2026-77057 with a different title (UI layer restriction); CERT Polska's CWE-307 (excessive authentication attempts) matches the described behavior and is used. The sources do not state a public PoC, in-the-wild exploitation, CISA KEV listing, threat actor or network IOCs. CVE-2026-77052 / CVE-2026-77053 are the headline scores; the record's CVSS is the 4.0 score and vector from the NVD entry for CVE-2026-77053.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.001 Valid Accounts: Default Accounts
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- T1611 Escape to Host
- T1110.001 Brute Force: Password Guessing
- T1110.002 Brute Force: Password Cracking
- T1552.001 Unsecured Credentials: Credentials In Files
- T1082 System Information Discovery
- T1529 System Shutdown/Reboot

## Sources

- [CERT Polska: Vulnerabilities in boneIO products](https://cert.pl/en/posts/2026/10/CVE-2026-77052/)
- [boneIO Black documentation](https://boneio.eu/en/docs/black)
- [NVD: CVE-2026-77052](https://nvd.nist.gov/vuln/detail/CVE-2026-77052)
- [NVD: CVE-2026-77053](https://nvd.nist.gov/vuln/detail/CVE-2026-77053)
- [NVD: CVE-2026-77054](https://nvd.nist.gov/vuln/detail/CVE-2026-77054)
- [NVD: CVE-2026-77055](https://nvd.nist.gov/vuln/detail/CVE-2026-77055)
- [NVD: CVE-2026-77056](https://nvd.nist.gov/vuln/detail/CVE-2026-77056)
- [NVD: CVE-2026-77059](https://nvd.nist.gov/vuln/detail/CVE-2026-77059)
- [CERT Polska Coordinated Vulnerability Disclosure policy](https://cert.pl/en/cvd/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4460