CVE-2026-77061
Medium
Description
boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and enables targeted attacks against the device. This issue was fixed in version 1.6.0: every API route requires an authenticated role, the interactive API documentation is disabled, and the serial number is withheld from anonymous callers.
SeverityMedium
CVSS5.3
Exploit probability—
ProductboneIO
PublishedOct 26, 2026
First seenOct 26, 2026
Weakness typeCWE-306Missing authentication for critical function
How to fix
Update
- boneIO boneIO1.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| boneIO boneIO | 1.2.0 ≤ v < 1.6.0 | 1.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.