Vulnerability · Published Oct 26, 2026 · Assigned by CERT-PL

CVE-2026-77061Missing Authentication for Critical Function in boneIO

Medium 5.3

In plain English

A medium-severity missing authentication in boneIO from boneIO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.3%top 73.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and enables targeted attacks against the device. This issue was fixed in version 1.6.0: every API route requires an authenticated role, the interactive API documentation is disabled, and the serial number is withheld from anonymous callers.

Affected products (as reported)

Vendor	Product	Versions
boneIO	boneIO	1.2.0 – before 1.6.0

Weakness: CWE-306 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2026/10/CVE-2026-77052 third-party-advisory
https://boneio.eu/en/docs/black product