CVE-2026-77057
Improper Restriction of Excessive Authentication Attempts in boneIO
boneIO boneIO
CVSS
2.3LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 1.6.0boneIOCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access to the device.
This issue was fixed in version 1.6.0: web login attempts are rate-limited per source address and per account, panel passwords must be at least 8 characters long, and SSH allows three authentication attempts per connection with a shortened login grace time.
Text from CVE List
Affected versions 1
- boneIOaffected: 1.2.0 before 1.6.0CVE List