CVE-2026-77061

MEDIUM 5.3CVE-2026-77061 · Published 26/10/2026 · updated 26/10/2026

In short

CVE-2026-77061 is a MEDIUM (CVSS 5.3) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.33%, higher than 26.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and enables targeted attacks against the device. This issue was fixed in version 1.6.0: every API route requires an authenticated role, the interactive API documentation is disabled, and the serial number is withheld from anonymous callers.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free