{"metadata": {"vulnerability": "CVE-2026-77053", "count": 15, "kinds": {"milestone": 4, "sighting": 6, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-08-20T09:37:37.786Z", "date_only": false, "value": "2026-08-20T09:37:37.786Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-77053", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-26T06:55:00Z", "date_only": false, "value": "2026-10-26T06:55:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cert.pl/en/posts/2026/10/CVE-2026-77052", "record": "CVE-2026-77053", "field": "creation_timestamp", "uuid": "e3dc8cb3-d8a1-4bfa-a4d0-d7a16f0e5b49", "url": "https://cert.pl/en/posts/2026/10/CVE-2026-77052"}, {"timestamp": "2026-10-26T14:45:42.165Z", "date_only": false, "value": "2026-10-26T14:45:42.165Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-77053", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T14:45:42.165Z", "date_only": false, "value": "2026-10-26T14:45:42.165Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-77053", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-26T14:45:42.165Z", "date_only": false, "value": "2026-10-26T14:45:42.165Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CERT-PL", "record": "CVE-2026-77053", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-26T15:07:35.040Z", "date_only": false, "value": "2026-10-26T15:07:35.040305Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117507834149525263", "record": "CVE-2026-77053", "field": "creation_timestamp", "uuid": "645051c5-e571-43cc-b68a-ea8c97c1e379", "content": "CVE-2026-77053 Missing Authentication in Default Configuration in boneIO boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuration, and operating connected physical circuits.This issue was fixed in version 1.6.0: a device without an administrator account refuses API requests until the owner creates one in the first-run wizard, and every API route is restricted to an authenticated role.\nVersions before 1.2.0 are based on Debian 10, are no longer supported and cannot be upgraded in place; affected devices should be re-flashed with the 1.6.0 system image.\nhttps://www.cve.org/CVERecord?id=CVE-2026-77053https://cert.pl/en/posts/2026/10/CVE-2026-77052https://boneio.eu/en/docs/black#boneio #boneIO#CVE_2026_77053#bot", "url": "https://infosec.exchange/users/cve/statuses/117507834149525263"}, {"timestamp": "2026-10-26T15:08:15.234Z", "date_only": false, "value": "2026-10-26T15:08:15.234309Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117507836786420668", "record": "CVE-2026-77053", "field": "creation_timestamp", "uuid": "d00ecff2-1042-459b-b72f-c8c6bb27a936", "content": "CVE-2026-77054 Cleartext Storage of Sensitive Information in boneIO boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the endpoint and access the administrative passwords in cleartext form. Critically, due to CVE-2026-77053 (authentication disabled by default), an unauthenticated attacker on the same local network can retrieve all passwords.\nThis issue was fixed in version 1.6.0: web panel passwords are stored as salted scrypt hashes in a file readable only by the service account, and the API and logs no longer return secret values. The MQTT broker password has to stay recoverable because the application presents it to the broker as a client; it is kept in a separate file readable only by the service account and is no longer exposed through the API.\nhttps://www.cve.org/CVERecord?id=CVE-2026-77054https://cert.pl/en/posts/2026/10/CVE-2026-77052https://boneio.eu/en/docs/black#boneio #boneIO#CVE_2026_77054#bot", "url": "https://infosec.exchange/users/cve/statuses/117507836786420668"}, {"timestamp": "2026-10-26T15:10:56.599Z", "date_only": false, "value": "2026-10-26T15:10:56.599534Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117507847351695104", "record": "CVE-2026-77053", "field": "creation_timestamp", "uuid": "df933459-7c7d-4493-becc-14a861399ea4", "content": "CVE-2026-77058 Cross-Site Request Forgery (CSRF) in boneIO boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin requests to the device. This allows the attacker to reboot the controller, toggle relay circuits, control gates and blinds, or shut down the device, causing loss of integrity and availability. Critically, due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website.\nThis issue was fixed in version 1.6.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-77058https://cert.pl/en/posts/2026/10/CVE-2026-77052https://boneio.eu/en/docs/black#boneio #boneIO#CVE_2026_77058#bot", "url": "https://infosec.exchange/users/cve/statuses/117507847351695104"}, {"timestamp": "2026-10-26T15:13:37.649Z", "date_only": false, "value": "2026-10-26T15:13:37.649560Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117507857912491533", "record": "CVE-2026-77053", "field": "creation_timestamp", "uuid": "17796adc-48f1-4414-a714-1cbc3088309e", "content": "CVE-2026-77062 Clickjacking in boneIO The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malicious web page and trick an authenticated user on the internal network into clicking buttons that activate relays, open gates, or control blinds. This can lead to unauthorized state changes with potential physical safety consequences. Critically, due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website.\nThis issue was fixed in version 1.6.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-77062https://cert.pl/en/posts/2026/10/CVE-2026-77052https://boneio.eu/en/docs/black#boneio #boneIO#CVE_2026_77062#bot", "url": "https://infosec.exchange/users/cve/statuses/117507857912491533"}, {"timestamp": "2026-10-26T15:16:42Z", "date_only": false, "value": "2026-10-26T15:16:42Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-82CX-36PH-PCCQ", "record": "GHSA-82CX-36PH-PCCQ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-26T15:16:42.827Z", "date_only": false, "value": "2026-10-26T15:16:42.827", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77053", "record": "FKIE_CVE-2026-77053", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T15:34:48Z", "date_only": false, "value": "2026-10-26T15:34:48Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-82CX-36PH-PCCQ", "record": "GHSA-82CX-36PH-PCCQ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T15:34:48Z", "date_only": false, "value": "2026-10-26T15:34:48Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-82CX-36PH-PCCQ", "record": "GHSA-82CX-36PH-PCCQ", "field": "modified"}, {"timestamp": "2026-10-26T17:11:35.487Z", "date_only": false, "value": "2026-10-26T17:11:35.487", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77053", "record": "FKIE_CVE-2026-77053", "field": "lastModified"}, {"timestamp": "2026-10-27T03:30:04.468Z", "date_only": false, "value": "2026-10-27T03:30:04.468824Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mytcbypbru22", "record": "CVE-2026-77053", "field": "creation_timestamp", "uuid": "c987aad2-0b1b-4b16-9de7-df636489b87d", "content": "CVE-2026-77053 - boneio\nThe boneIO device runs its web management interface openly, letting anyone on the network change settings, shut it down, or control attached hardware. Upgrade to version 1.6.0 or re-flash older\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#boneio #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mytcbypbru22"}], "metrics": {"as_of": "2026-10-31T08:03:10.427Z", "anchors": {"origin": {"timestamp": "2026-10-26T14:45:42.165Z", "date_only": false, "value": "2026-10-26T14:45:42.165Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-77053", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-26T14:45:42.165Z", "date_only": false, "value": "2026-10-26T14:45:42.165Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-77053", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 407848.262132, "hours": 113.29118392555556, "days": 4.720465996898148, "min_seconds": 407848.262132, "max_seconds": 407848.262132, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-26T14:45:42.165Z", "date_only": false, "value": "2026-10-26T14:45:42.165Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-77053", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-31T08:03:10.427Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}