CVE-2026-77052

Vendor

BoneIO

Product

boneIO

CVSS v4.0

8.7 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

0.003 (p26)

Weakness

CWE-306

Exposure class

Edge / VPN / firewall, OT / ICS

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 35
   CVE NVD 5d ago

   boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy.

   boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated…

   CVSS 8.7 Fix available CVE-2026-77052 BoneIO
2. 17
   Advisory CERT Polska 5d ago

   Vulnerabilities in boneIO products

   CERT Polska has received a report about 11 vulnerabilities (from CVE-2026-77052 to CVE-2026-77062) found in boneIO products.

   CVE-2026-77052CVE-2026-77062