CERT Polska: boneIO Flaws Let Attackers Take Over Home Automation Controllers

On October 26, CERT Polska published details of vulnerabilities in boneIO products. One of them lets an attacker on the local network run commands without logging in and take over the home automation system. The vendor fixed the reported issues in version 1.6.0.

What was disclosed

CVE-2026-77052 concerns a Node-RED service that is exposed without authentication. Its interface lets anyone deploy flows that execute system commands. A second vulnerability, CVE-2026-77053, comes from authentication being disabled by default on the management interface.

The other disclosed issues include passwords leaking through the API and a service account with excessive privileges. Taken together, these weaknesses can make it easier to take over the device and control the connected circuits. Note that local network access is not the same thing as being able to attack every controller directly from the internet.

Who is at risk

Anyone running boneIO Black, or the black_debian_images system images, should check their installations. People who manage networks where the automation system shares access with user computers or guest devices should pay particular attention.

According to CERT Polska, releases older than 1.2.0 run on the unsupported Debian 10 and need to be reflashed with the 1.6.0 image. Updating an existing installation may also keep the old MQTT broker credentials in place, so check those separately.

What to do now

• Identify the device model, the software version and how the system was installed.
• Deploy version 1.6.0 following the vendor’s instructions. Before you do, back up the configuration and have a plan for restoring the automation if something goes wrong.
• Change the default MQTT credentials and any passwords that may have been exposed through the configuration interface.
• Restrict access to the dashboard, SSH and Node-RED to a separate management network.
• After the update, review the administrator accounts and confirm that gates, blinds and the other controlled circuits work correctly.

SecurHUB’s take

Automation controllers should get the same update and access oversight as the rest of your network devices. A security audit can help you find out who really has access to the management panels and how to contain the damage if a single device is compromised.

Sources: CERT Polska, Vuln Scoop