The gate controller asked for no password

CERT Polska, Poland's national computer emergency response team, has published eleven vulnerabilities in boneIO products, including boneIO Black, a home-automation controller that drives relays, blinds and gates. CERT Polska coordinated the disclosure after receiving the report and credits Mateusz Włodarczak of s3ga with it. Every flaw is fixed in version 1.6.0.

The central flaw is a default. Under CVE-2026-77053, boneIO Black firmware requires no authentication out of the box: its web management API listens on all network interfaces and serves every endpoint without credentials. According to CERT Polska, a remote, unauthenticated attacker can therefore take full control of the device, cause a denial of service, change its configuration and operate the physical circuits connected to it. Separately, CVE-2026-77052 exposes a Node-RED instance without authentication at /nodered/; its API allows deploying flows that run arbitrary system commands, which gives an attacker on the local network remote code execution.

Several of the other flaws matter mainly because of that default. Passwords for the MQTT broker and the web panel were stored in plaintext and returned in full by GET /api/config (CVE-2026-77054), so anyone on the same local network could read them. The bundled Mosquitto broker used the same default credentials on every device, documented publicly on GitHub (CVE-2026-77056). The API had no CSRF tokens and the panel no clickjacking protection; with authentication off, CERT Polska notes, any user of the internal network who visits a malicious page could set off the attacker's actions, from switching relays to opening gates. The rest concern local escalation to root, unlimited login attempts, a password file any local user could read and endpoints that gave out logs and the serial number without authentication.

Version 1.6.0 changes the default: a device without an administrator account rejects API requests until the owner creates one, and every API path requires authentication. Devices updated from earlier versions keep their existing MQTT credentials, which should be changed. Versions older than 1.2.0 are unsupported and cannot be updated; they need the 1.6.0 system image.