Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-77054— Cleartext Storage of Sensitive Information in boneIO

Quick assessment

Affected
boneIO boneIO
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

boneIO Black 将密码（包括 MQTT 代理和 Web 面板的密码）以明文形式存储。GET /api/config 接口会返回完整配置，其中包含子服务的密码明文。任何已认证用户均可调用该接口，从而以明文形式获取管理密码。更严重的是，由于 CVE-2026-77053 导致默认情况下认证功能被禁用，同一局域网内的未认证攻击者也能获取所有密码。 该问题已在 1.6.0 版本中修复：Web 面板密码现以加盐的 scrypt 哈希形式存储，且仅服务账户可读；API 和日志中不再返回任何敏感值。MQTT 代理密码仍

CVSS 6.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77054

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cleartext Storage of Sensitive Information in boneIO
Source: CVE Program / CVE List V5
Vulnerability Description
boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the endpoint and access the administrative passwords in cleartext form. Critically, due to CVE-2026-77053 (authentication disabled by default), an unauthenticated attacker on the same local network can retrieve all passwords. This issue was fixed in version 1.6.0: web panel passwords are stored as salted scrypt hashes in a file readable only by the service account, and the API and logs no longer return secret values. The MQTT broker password has to stay recoverable because the application presents it to the broker as a client; it is kept in a separate file readable only by the service account and is no longer exposed through the API.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文存储
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
boneIO boneIO 1.2.0 ~ 1.6.0 -

II. Public POCs for CVE-2026-77054

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77054

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-77054 (1)

Vendor Pages for CVE-2026-77054 (1)

Same Patch Batch · boneIO · 2026-10-26 · 11 CVEs total

CVE-2026-77055 9.3 CRITICAL Improper Privilege Assignment in boneIO
CVE-2026-77059 8.8 HIGH TOCTOU Race Condition in boneIO
CVE-2026-77052 8.7 HIGH Missing Authentication for Node-RED in boneIO
CVE-2026-77053 8.7 HIGH Missing Authentication in Default Configuration in boneIO
CVE-2026-77056 7.1 HIGH Use of Default Credentials in boneIO
CVE-2026-77062 6.9 MEDIUM Clickjacking in boneIO
CVE-2026-77060 6.8 MEDIUM Incorrect Permission Assignment for Critical Resource in boneIO
CVE-2026-77061 5.3 MEDIUM Missing Authentication for Critical Function in boneIO
CVE-2026-77058 5.1 MEDIUM Cross-Site Request Forgery (CSRF) in boneIO
CVE-2026-77057 2.3 LOW Improper Restriction of Excessive Authentication Attempts in boneIO

IV. Related Vulnerabilities

Same product: boneIO
Same vendor: boneIO
Same weakness: CWE-312