Vulnerability · Published Oct 26, 2026 · Assigned by CERT-PL

CVE-2026-77058Cross-Site Request Forgery (CSRF) in boneIO

Medium 5.1

In plain English

A medium-severity cross-site request forgery in boneIO from boneIO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.3%top 82.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin requests to the device. This allows the attacker to reboot the controller, toggle relay circuits, control gates and blinds, or shut down the device, causing loss of integrity and availability. Critically, due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website. This issue was fixed in version 1.6.0.

Affected products (as reported)

Vendor	Product	Versions
boneIO	boneIO	1.2.0 – before 1.6.0

Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2026/10/CVE-2026-77052 third-party-advisory
https://boneio.eu/en/docs/black product