The boneIO black_debian_images package stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with permissions that allow any local user to read it. This exposure enables local users to obtain password hashes for all MQTT accounts and attempt offline dictionary attacks. The vulnerability was fixed in version 1.6.0.