Vulnerability · Published Oct 26, 2026 · Assigned by CERT-PL

CVE-2026-77062Clickjacking in boneIO

Medium 6.9

In plain English

A medium-severity security flaw in boneIO from boneIO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 55.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malicious web page and trick an authenticated user on the internal network into clicking buttons that activate relays, open gates, or control blinds. This can lead to unauthorized state changes with potential physical safety consequences. Critically, due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website. This issue was fixed in version 1.6.0.

Affected products (as reported)

Vendor	Product	Versions
boneIO	boneIO	1.2.0 – before 1.6.0

Weakness: CWE-1021 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2026/10/CVE-2026-77052 third-party-advisory
https://boneio.eu/en/docs/black product