CVE-2026-77057lowCWE-307

CVE-2026-77057: low-severity vulnerability in boneIO

Improper Restriction of Excessive Authentication Attempts in boneIO

Published · Updated

Follow this CVE+ Monitor boneIO

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.3epss 0.3%
boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access to the device. This issue was fixed in version 1.6.0: web login attempts are rate-limited per source address and per account, panel passwords must be at least 8 characters long, and SSH allows three authentication attempts per connection with a shortened login grace time.
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
boneIO · boneIO
Related CVEs — boneIO

In the same product, most dangerous first.

CVE-2026-77062MEDIUMClickjacking in boneIOEPSS 0.5%CVE-2026-77061MEDIUMMissing Authentication for Critical Function in boneIOEPSS 0.3%CVE-2026-77052HIGHMissing Authentication for Node-RED in boneIOEPSS 0.3%CVE-2026-77058MEDIUMCross-Site Request Forgery (CSRF) in boneIOEPSS 0.3%CVE-2026-77053HIGHMissing Authentication in Default Configuration in boneIOEPSS 0.3%CVE-2026-77054MEDIUMCleartext Storage of Sensitive Information in boneIOEPSS 0.2%