# CVE-2026-77057: boneIO Black brute-force attacks on web and SSH

Source: https://junglewise.ai/threats/cve-2026-77057-boneio-black-does-not-limit-authentication-attempts-on-its-web  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-77057 · Severity: info · Published 2026-10-26

boneIO Black is a home automation controller that manages electrical systems through a web interface and SSH access. The device fails to limit login attempts or enforce strong passwords, allowing attackers to repeatedly guess credentials and gain full control of the automation system, potentially disrupting lighting, locks, heating, and other connected devices.

Technologies: [boneIO Black](https://junglewise.ai/threats/technologies/boneio-black). Vendors: [boneIO](https://junglewise.ai/threats/vendors/boneio).

## Quick answers

**Is CVE-2026-77057 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77057 being exploited in the wild.

**How severe is CVE-2026-77057?** Informational severity, published 26 October 2026.

**Which products and versions are affected?** boneIO Black before 1.6.0.

**Is there a fix for CVE-2026-77057?** Yes: fixed in 1.6.0. Until then: Restrict network access to the web interface (port 8443) and SSH service to trusted networks only using a firewall or access control rules. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77057 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-77057?** Check whether you run boneIO Black at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.6.0

Restrict network access to the web interface (port 8443) and SSH service to trusted networks only using a firewall or access control rules.

## Technical details

The vulnerability consists of two separate weaknesses: the POST /api/login endpoint on the web interface and the SSH service lack rate-limiting on authentication attempts, and password complexity is not enforced. An unauthenticated remote attacker can perform brute-force attacks over the network without restriction; the fix (version 1.6.0) adds per-source and per-account rate-limiting on web logins, enforces 8-character minimum passwords, and limits SSH to three attempts per connection.

## Affected products

- boneIO Black before 1.6.0

## Timeline

- 2026-10-26: disclosed

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://boneio.eu/en/docs/black](https://boneio.eu/en/docs/black)

## Related threats

- [boneIO Black web interface clickjacking vulnerability](https://junglewise.ai/threats/cve-2026-77062-the-boneio-black-web-interface-lacks-proper-clickjacking)
- [boneIO Black authentication bypass on API endpoints](https://junglewise.ai/threats/cve-2026-77061-boneio-black-directly-excludes-several-api-endpoints-from-the)
- [boneIO Black TOCTOU race condition in timezone_sudoers](https://junglewise.ai/threats/cve-2026-77059-boneio-black-contains-a-toctou-race-condition-in-the-create)
- [boneIO Black Cross-Site Request Forgery on state-changing API endpoints](https://junglewise.ai/threats/cve-2026-77058-boneio-black-is-vulnerable-to-cross-site-request-forgery-csrf-on)
- [boneIO Black cleartext password storage in config endpoint](https://junglewise.ai/threats/cve-2026-77054-boneio-black-stores-passwords-including-the-mqtt-broker-and-web)