boneIO's black_debian_images includes a Mosquitto MQTT broker that uses identical default credentials on every device. These credentials are publicly documented on GitHub and the installation instructions do not require changing them. A remote attacker can log in with the default credentials, obtain full read and write access, and control connected electromechanical devices such as relays, blinds and gates, as well as inject false entities into a linked Home Assistant instance. The vulnerability is classified as CWE-1392.

The affected product is boneIO black_debian_images, any deployment of earlier than version 1.6.0 of the image. Version 1.6.0 introduces per-device generated MQTT passwords at first boot. Devices that are upgraded from earlier releases keep their original broker credentials until the owner changes them via the web panel.

The CVSS score of 7.1 indicates a high risk level. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, yet the use of constant default credentials makes exploitation straightforward and likely. The attack vector is remote access to the MQTT broker using known default credentials; no additional vulnerability exploitation or privilege escalation is required.