boneIO Black CVE-2026-77052

The specific prerequisite is that boneIO Black (versions before 1.6.0) ships a Node-RED instance reachable without any authentication at the /nodered/ path through its Caddy reverse proxy, and the Node-RED Admin API permits deploying flows that execute system commands - no credentials, tokens, or user interaction are needed against this default configuration. The primary LIMITING factor is the attack vector: CVSS AV:A means the attacker must have adjacent/local-network access to the device, not internet reachability, so exposure depends on network segmentation and whether the device's management interface is reachable by untrusted hosts. The other limiting factor is version: devices updated to 1.6.0 or later are fixed.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes a low-complexity, unauthenticated attack requiring no user interaction, with high impact to confidentiality, integrity and availability of the vulnerable system (VC:H/VI:H/VA:H) plus low subsequent-system impact (SC:L/SI:L/SA:L), yielding a score of 8.7. The root cause (CWE-306, missing authentication) is simple and reliable to exploit, and the outcome is full remote code execution over the home automation device. The one factor that meaningfully tempers raw severity is the attack vector: AV:A means the attacker must be on the adjacent/local network, not the open internet, so this is a LAN-adjacency flaw rather than an internet-wide mass-exploitation candidate. The vuln.today decision label is 'this_week' and the issue was reported by CERT-PL, both signalling real urgency. Key risk signals are MISSING and should not be assumed: no EPSS exploitation-probability score was provided, there is no CISA KEV listing, and no proof-of-concept or exploit reference was supplied beyond the CERT-PL advisory and vendor docs. Net assessment: credible, easy, high-impact RCE whose practical blast radius is bounded by the requirement for local-network access.

An attacker who gains a foothold on the same local network as a boneIO Black device (for example via a compromised IoT device, guest Wi-Fi, or a malicious insider) browses to the unauthenticated /nodered/ endpoint exposed through the Caddy reverse proxy. They use the Node-RED Admin API to deploy a flow that runs arbitrary system commands, achieving remote code execution and full control of the home automation controller. No proof-of-concept or working exploit code was provided in the input, only the CERT-PL advisory and vendor documentation.