boneIO Black home automation flaws enable full takeover
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
Eleven CVEs in boneIO Black controllers allow unauthenticated local-network attackers to achieve RCE, read passwords, and seize full device control; fixed in v1.6.0.
CERT Polska coordinated disclosure of eleven vulnerabilities (CVE-2026-77052 through CVE-2026-77062) affecting boneIO Black home-automation controllers and their underlying black_debian_images, spanning firmware versions 1.0.0 through 1.6.0. The most severe issues stem from authentication being disabled by default (CVE-2026-77053), which exposes the entire management API on all network interfaces to any unauthenticated attacker on the local network, allowing full device control, denial of service, and manipulation of connected relays, gates and blinds. This same flaw cascades into several other issues: an exposed, unauthenticated Node-RED instance (CVE-2026-77052) lets an attacker deploy flows for arbitrary command execution; cleartext storage of MQTT and web-panel passwords (CVE-2026-77054) becomes remotely retrievable; and CSRF (CVE-2026-77058) and clickjacking (CVE-2026-77062) weaknesses become exploitable by any internal-network visitor to a malicious page, not just authenticated users.
Additional issues include hardcoded/default Mosquitto MQTT credentials published on GitHub (CVE-2026-77056), excessive sudo and Docker-group privileges for the boneio service account enabling local root escalation (CVE-2026-77055), a TOCTOU race condition in sudoers-file handling also leading to root privilege escalation (CVE-2026-77059), world-readable MQTT password hashes (CVE-2026-77060), missing brute-force protections on login and SSH (CVE-2026-77057), unauthenticated reconnaissance endpoints leaking system/firmware details (CVE-2026-77061), and insecure file permissions (CVE-2026-77060). All issues are fixed in boneIO 1.6.0, which introduces mandatory first-run authentication setup, scrypt password hashing, per-device MQTT credentials, rate limiting, CSRF/clickjacking protections, and removal of excessive sudo/docker privileges via signed migrations.
Devices running firmware before 1.2.0 are based on an unsupported Debian 10 image and cannot be upgraded in place — they must be re-flashed with the 1.6.0 image. Defenders operating boneIO Black controllers should upgrade immediately, verify an administrator account was created during first-run setup, rotate all MQTT and web-panel passwords (especially on devices upgraded from older releases, which retain old credentials), and restrict network access to the controller's management interfaces. No in-the-wild exploitation is reported; this is a responsibly disclosed vulnerability set via CERT Polska's CVD process.
Mentioned in this report
Detection guidance
Node-RED Process Spawning Shell With Download or Reverse-Shell Commands
Node-RED (node) spawning a shell that runs download, reverse-shell or exec-staging commands, as seen when an unauthenticated Node-RED instance is abused to deploy command-execution flows. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node-RED Process Spawning Shell With Download or Reverse-Shell Commands
description: Detects a Node.js/Node-RED process spawning a shell whose command line
downloads content, stages an executable or opens a reverse shell. Matches abuse
of an exposed unauthenticated Node-RED instance (exec-node flows) on IoT controllers
such as boneIO Black.
tags:
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /node
- /node-red
Image|endswith:
- /sh
- /bash
- /dash
CommandLine|contains:
- 'curl '
- 'wget '
- /dev/tcp/
- nc -e
- mkfifo
- chmod +x
condition: selection
falsepositives:
- Legitimate Node-RED flows using exec nodes to fetch scripts or call curl for home
automation integrations
- Administrators deploying update scripts through Node-RED
level: medium
id: cc172634-fedd-5813-9b87-1394b751c669
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-77052
Docker Run With Privileged Mode or Host Root Mount
Docker container launched with --privileged, host PID namespace or the host root filesystem mounted, a common local root escalation path when a service account has excessive Docker group rights. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Docker Run With Privileged Mode or Host Root Mount
description: Detects docker run invoked with --privileged, host PID namespace or the
host root filesystem bind-mounted. Abused for local root escalation when a low-privileged
service account (for example the boneio account) has docker group or sudo rights.
tags:
- attack.privilege-escalation
- attack.t1611
logsource:
category: process_creation
product: linux
detection:
selection_docker:
CommandLine|contains: docker run
selection_priv:
CommandLine|contains:
- --privileged
- ' -v /:/'
- --volume /:/
- --volume=/:/
- --pid=host
- --pid host
condition: selection_docker and selection_priv
falsepositives:
- Administrators running privileged utility containers for debugging or device access
- Provisioning scripts that start privileged containers for hardware access
level: medium
id: f13fdb40-9457-5247-9490-bb58434fb8bb
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-77052
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-77052
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,237 reports from 143 sources, 591 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs