Is CVE-2026-77056 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77056 being exploited in the wild.

How severe is CVE-2026-77056?

Informational severity, published 26 October 2026.

Which products and versions are affected?

boneIO Black Debian Images 1.2.0 to 1.6.0.

How is CVE-2026-77056 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-77056?

Check whether you run boneIO Black Debian Images at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77056: boneIO black_debian_images default MQTT broker credentials

CVE-2026-77056 · Severity: info · Published 2026-10-26

boneIO Black is a DIN-rail home automation controller that ships with a Mosquitto MQTT message broker configured with publicly documented default credentials that are never changed unless the user manually does so. A remote attacker who obtains these credentials can gain full read and write access to the broker, allowing them to control connected relays, blinds, and gates, and inject fake sensor data into linked Home Assistant systems, potentially disabling critical home functions.

Technologies: boneIO Black Debian Images. Vendors: boneIO.

Quick answers

Is CVE-2026-77056 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77056 being exploited in the wild.
How severe is CVE-2026-77056?: Informational severity, published 26 October 2026.
Which products and versions are affected?: boneIO Black Debian Images 1.2.0 to 1.6.0.
Is there a fix for CVE-2026-77056?: Yes: fixed in 1.6.0. Until then: Devices upgraded from versions earlier than 1.6.0 retain the published default broker credentials; the owner must manually change the MQTT password via the web panel before upgrading is complete. Devices before version 1.2.0 cannot be upgraded in place and should be re-flashed with version 1.6.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77056 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-77056?: Check whether you run boneIO Black Debian Images at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.6.0

Devices upgraded from versions earlier than 1.6.0 retain the published default broker credentials; the owner must manually change the MQTT password via the web panel before upgrading is complete. Devices before version 1.2.0 cannot be upgraded in place and should be re-flashed with version 1.6.0.

Technical details

The vulnerability is use of default credentials (CWE-1392) in the Mosquitto MQTT broker shipped with boneIO black_debian_images versions 1.2.0 to 1.6.0. The same hardcoded credentials are present on every device and are publicly documented, allowing any network-adjacent or remote attacker to authenticate to the broker and publish/subscribe to all topics. An attacker gains full control over MQTT-connected devices and can interfere with Home Assistant automations. Mitigation requires manual credential rotation or upgrading to 1.6.0 where credentials are generated per-device at first boot.

Affected products

boneIO black_debian_images 1.2.0 to 1.6.0

Timeline

2026-10-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.