CVE-2026-77056
boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default…
- Risk score
- 43/100
- CVSS
- 7.1 v4.0
- Published
- 26 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allow…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.6.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.1 high
References
Original description
boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation. This issue was fixed in version 1.6.0 of the image: MQTT passwords are generated per device at first boot. Devices upgraded from earlier versions keep their existing broker credentials; from boneio 1.6.0 the web panel reports credentials that are still the published defaults, and the owner has to change them.
Last activity 26 Oct 2026. Patch Forecast updates every hour.