boneIO black_debian_images containers store the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. This permits any local user to read the password hashes for all MQTT accounts, enabling offline dictionary attacks to recover clear-text passwords and gain unauthorized access to the MQTT network.

Vulnerable images are boneIO black_debian_images, versions older than 1.6.0. The issue has been fixed in version 1.6.0, which removes the world-readable permission on the password file. Containers built before 1.6.0 or running older images are at risk.

The CVSS score of 6.8 indicates moderate severity. The attack vector is local; any user with access to the container or host can read the file. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited widespread exploitation, but the potential to acquire MQTT credentials remains a critical concern.