The boneIO Black web interface does not implement clickjacking protections, allowing a remote attacker to embed the control panel within an iframe on a nefarious page. By tricking an authenticated user into clicking elements, the attacker can cause relays to activate, gates to open, or blinds to move, creating potential safety hazards.

All boneIO installations running a version before 1.6.0 are vulnerable. The fix appears in version 1.6.0. In addition, a related issue (CVE‑2026‑77053) disables authentication by default, which means any user on the internal network can be coerced into submitting clicks by visiting a malicious site.

The CVSS score of 6.9 indicates medium severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. Attackers need only host a malicious webpage on the internal network and entice a user to visit it. Because authentication is frequently disabled in the default configuration, the barrier to successful exploitation is low, making this vulnerability readily exploitable in the target environment.