boneIO vulnerabilities
We track 5 vulnerabilities in boneIO products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 26, 2026.
Latest boneIO vulnerabilities
- 8.8 High severity
boneIO: Time-of-check Time-of-use (TOCTOU) Race Condition
boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileg
- 7.1 High severity
black_debian_images: Use of Default Credentials
boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use t
- 9.3 Critical severity
black_debian_images: Incorrect Privilege Assignment
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This is
- 8.7 High severity
boneIO: Missing Authentication for Critical Functionality
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing deni
- 8.7 High severity
boneIO: Missing Authentication for Critical Functionality
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can