CVE-2026-77056High· 7.1▾ TwilightboneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A re…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation.
This issue was fixed in version 1.6.0 of the image: MQTT passwords are generated per device at first boot. Devices upgraded from earlier versions keep their existing broker credentials; from boneio 1.6.0 the web panel reports credentials that are still the published defaults, and the owner has to change them.
black_debian_images >= 1.2.0 < 1.6.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77055Critical· 9.3Improper Privilege Assignment in boneIO
CVE-2026-77060Medium· 6.8Incorrect Permission Assignment for Critical Resource in boneIO
CVE-2026-77054Medium· 6.9Cleartext Storage of Sensitive Information in boneIO
CVE-2026-77053High· 8.7Missing Authentication in Default Configuration in boneIO
CVE-2026-77052High· 8.7Missing Authentication for Node-RED in boneIO
CVE-2026-77062Medium· 6.9Clickjacking in boneIO