The boneIO Black web interface has a clickjacking vulnerability that allows remote attackers to embed the control panel in an iframe on a malicious website. Authenticated users on the internal network can be tricked into clicking interface elements, causing unauthorized control of physical devices such as relays, gates, or blinds. This vulnerability is compounded by CVE-2026-77053, which disables authentication by default, enabling any internal network user to perform attacker-controlled actions. The issue was fixed in version 1.6.0.