CVE-2026-77054

Vendor

BoneIO

Product

boneIO

CVSS v4.0

6.9 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness

CWE-312

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 10
   CVE NVD 5d ago

   boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext.

   boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the…

   CVSS 6.9 Fix available CVE-2026-77054 BoneIO