CVE-2026-77054

Cleartext Storage of Sensitive Information in boneIO

Published Oct 26, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the endpoint and access the administrative passwords in cleartext form. Critically, due to CVE-2026-77053 (authentication disabled by default), an unauthenticated attacker on the same local network can retrieve all passwords.

This issue was fixed in version 1.6.0: web panel passwords are stored as salted scrypt hashes in a file readable only by the service account, and the API and logs no longer return secret values. The MQTT broker password has to stay recoverable because the application presents it to the broker as a client; it is kept in a separate file readable only by the service account and is no longer exposed through the API.

Analysis

Technical impact

Passwords for the MQTT broker, web panel, and other services are stored in cleartext (CWE‑312) and the /api/config endpoint exposes them in the response to any authenticated user. As a result, anyone able to authenticate to the device can obtain full administrative credentials, and due to a separate defect that leaves authentication disabled by default, an attacker on the same local network can read these secrets without authentication. This exposure enables credential theft, privilege escalation, and full compromise of the device, as the attacker gains both the ability to control the MQTT broker and the web interface.

Affected Systems

boneIO devices running versions prior to 1.6.0 are affected. The vulnerable configuration includes the web panel, MQTT broker, and any sub‑services for which passwords are stored directly in configuration files and can be retrieved via the API.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and while the EPSS score is not available, the fact that the vulnerability can be exploited without authentication on the same local network elevates its practical risk. The issue is not listed in the CISA KEV catalog, but attackers could leverage the exposed credentials to take full control of the device and any systems the device communicates with.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

boneIO

unaffected

Version	Status	Constraints
`1.2.0`	affected	< 1.6.0

No data.

Vendor Product Versions

Boneio

Version	Status	Scheme	Platform
`[1.2.0,1.6.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade boneIO to version 1.6.0 or later, which hashes web panel passwords with salted scrypt and removes secret values from API responses.
Restrict or disable the /api/config endpoint for non‑authorized users, ensuring only privileged administrators can query configuration.
If the device must remain on the local network, isolate it from the internet or other critical systems using network segmentation or firewall rules.

Generated by OpenCVE AI on October 26, 2026 at 17:08 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.156% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://boneio.eu/en/docs/black
https://cert.pl/en/posts/2026/10/CVE-2026-77052

History

Oct 26, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 3:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the endpoint and access the administrative passwords in cleartext form. Critically, due to CVE-2026-77053 (authentication disabled by default), an unauthenticated attacker on the same local network can retrieve all passwords. This issue was fixed in version 1.6.0: web panel passwords are stored as salted scrypt hashes in a file readable only by the service account, and the API and logs no longer return secret values. The MQTT broker password has to stay recoverable because the application presents it to the broker as a client; it is kept in a separate file readable only by the service account and is no longer exposed through the API.
Title		Cleartext Storage of Sensitive Information in boneIO
First Time appeared		Boneio Boneio boneio
Weaknesses		CWE-312
CPEs		cpe:2.3:a:boneio:boneio::::::::
Vendors & Products		Boneio Boneio boneio
References		https://boneio.eu/en/docs/black https://cert.pl/en/posts/2026/10/CVE-2026-77052
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`