black_debian_images vulnerabilities
CVEs whose affected-version data names the black_debian_images package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-77056High· 7.1Use of Default Credentials in boneIO
boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A re…
CVE-2026-77060Medium· 6.8Incorrect Permission Assignment for Critical Resource in boneIO
boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks.…
CVE-2026-77055Critical· 9.3Improper Privilege Assignment in boneIO
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to es…