{"id":"CVE-2026-77057","title":"Improper Restriction of Excessive Authentication Attempts in boneIO","summary":"boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potent…","severity":"low","cvss":2.3,"cvssVector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-307"],"vendor":"boneIO","product":"boneio","affected":["boneio >= 1.2.0 < 1.6.0"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T14:45:56.237Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-77057","references":[{"url":"https://cert.pl/en/posts/2026/10/CVE-2026-77052"},{"url":"https://boneio.eu/en/docs/black"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T15:29:30.512Z","slug":"CVE-2026-77057","body":"## Overview\n\nboneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access to the device.\n\nThis issue was fixed in version 1.6.0: web login attempts are rate-limited per source address and per account, panel passwords must be at least 8 characters long, and SSH allows three authentication attempts per connection with a shortened login grace time.\n\n## Affected\n\n- `boneio >= 1.2.0 < 1.6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":13,"depthScoreParts":{"impact":12.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}