Search: CVE-2026-77053

boneIO Black firmware versions prior to 1.6.0 have authentication disabled by default on their management web API, exposing all endpoints without requiring credentials. This allows unauthenticated remote attackers to fully control the device, including causing denial of service, modifying configurations, and operating connected physical circuits. The issue was fixed in version 1.6.0 by requiring an administrator account creation during the first-run wizard and restricting API routes to authenticated roles. Versions before 1.2.0 are based on Debian 10, unsupported, and cannot be upgraded in place; affected devices must be re-flashed with the 1.6.0 system image.