Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-77060— Incorrect Permission Assignment for Critical Resource in boneIO

Quick assessment

Affected
boneIO black_debian_images
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

boneIO 的 black_debian_images 镜像将 Mosquitto MQTT 代理的密码文件存储在 ，且该文件被设置为全局可读权限。任何本地用户均可读取所有 MQTT 账户的密码哈希值，并实施离线字典攻击。 该问题已在 1.6.0 版本中修复。

CVSS 6.8 · Medium

Possible ATT&CK Techniques 1 AI

T1110.001 · Password Guessing
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77060

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Incorrect Permission Assignment for Critical Resource in boneIO
Source: CVE Program / CVE List V5
Vulnerability Description
boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks. This issue was fixed in version 1.6.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键资源的不正确权限授予
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
boneIO black_debian_images 1.2.0 ~ 1.6.0 -

II. Public POCs for CVE-2026-77060

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77060

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-77060 (1)

Vendor Pages for CVE-2026-77060 (1)

Same Patch Batch · boneIO · 2026-10-26 · 11 CVEs total

CVE-2026-77055 9.3 CRITICAL Improper Privilege Assignment in boneIO
CVE-2026-77059 8.8 HIGH TOCTOU Race Condition in boneIO
CVE-2026-77052 8.7 HIGH Missing Authentication for Node-RED in boneIO
CVE-2026-77053 8.7 HIGH Missing Authentication in Default Configuration in boneIO
CVE-2026-77056 7.1 HIGH Use of Default Credentials in boneIO
CVE-2026-77054 6.9 MEDIUM Cleartext Storage of Sensitive Information in boneIO
CVE-2026-77062 6.9 MEDIUM Clickjacking in boneIO
CVE-2026-77061 5.3 MEDIUM Missing Authentication for Critical Function in boneIO
CVE-2026-77058 5.1 MEDIUM Cross-Site Request Forgery (CSRF) in boneIO
CVE-2026-77057 2.3 LOW Improper Restriction of Excessive Authentication Attempts in boneIO

IV. Related Vulnerabilities

Same product: black_debian_images
Same vendor: boneIO
Same weakness: CWE-732