boneIO Black CVE-2026-77053

The prerequisite is simply running an affected boneIO Black firmware version (before 1.6.0) in its default state: authentication is disabled out of the box and the management web API binds to all network interfaces, exposing every endpoint without credentials - so no non-default configuration is needed to be vulnerable, the insecure state is the default. The primary limiting factor is the CVSS Adjacent vector (AV:A): the attacker must be able to reach the device on its local network segment rather than across the open internet, so exploitation realistically requires LAN access or a management interface that has been exposed beyond the local network. Devices on versions before 1.2.0 are built on end-of-life Debian 10 and cannot be upgraded in place; they must be re-flashed with the 1.6.0 system image, which is a hard operational constraint on remediation. No authentication and no user interaction are required (PR:N/UI:N).

The input CVSS 4.0 score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H with low subsequent-system impact SC:L/SI:L/SA:L) describes a trivially exploitable missing-authentication flaw (CWE-306): no privileges, no user interaction, and no special attack requirement once the attacker can reach the device. The single most important mitigating signal is AV:A (Adjacent), not AV:N - exploitation requires the attacker to already be on the same network segment/L2 broadcast domain as the boneIO device, so this is not internet-wide drive-by exploitation unless the management interface has been deliberately exposed or the LAN is hostile. No EPSS probability, no CISA KEV listing, and no PoC reference are present in the input, so there is no evidence of active or automated exploitation; the vuln.today decision label is 'this_week', which is a prioritized-but-not-emergency signal consistent with the absence of KEV/EPSS data. This is therefore a genuine priority rather than a high-CVSS-but-low-real-risk issue, but its urgency is gated by exposure: on a flat or shared network it is a serious, high-impact flaw (full device takeover including operation of connected physical circuits, raising a physical-safety dimension beyond pure IT impact), while a properly segmented deployment sharply reduces real-world reachability. Missing data to note explicitly: no EPSS score and no KEV status are supplied, so wild-exploitation likelihood cannot be quantified from the input; and one reference URL points to CVE-2026-77052 rather than this CVE (-77053), which should be verified against the vendor/CERT-PL advisory.

An attacker with access to the same network as a boneIO Black device (for example a guest Wi-Fi segment, a compromised IoT host, or an untrusted building LAN) scans for the management web API, which listens on all interfaces with authentication disabled by default. Because no credentials are required, the attacker directly issues API calls to rewrite configuration, crash or hang the device (denial of service), and actuate the physical relays/circuits the controller drives. No public exploit identified at time of analysis, and no proof-of-concept reference is supplied, but the attack requires only ordinary HTTP requests given the AV:A/AC:L/PR:N/UI:N profile.