CVE-2026-77057: no brute-force limits on

CISO Take

boneIO Black, a home and building automation controller, does not rate-limit login attempts on its web interface (POST /api/login) or SSH service and does not enforce password complexity, so an unauthenticated remote attacker can guess credentials indefinitely. This is a conventional IoT weakness (CWE-307) rather than an AI-specific attack, and the AI relevance is tenuous: the device is classified as an ML UI component but has no tracked AI package, no known downstream dependents, and no stated AI function. There is no CVSS or EPSS score yet, it is not in CISA KEV, and no public exploit or Nuclei template exists, so near-term exploitation signals are absent, though brute-forcing is trivial to automate against any exposed instance. Upgrade to boneIO Black 1.6.0 or later, which adds per-source and per-account rate limiting, an 8-character minimum password, and tighter SSH attempt limits. Until then, keep the device off the internet and behind a VPN or network segment, and rotate any weak passwords.

Sources:NVDATLAScert.plboneio.eu

What is the risk?

Severity is unscored (no CVSS or EPSS). Exploitation is trivial in principle: no authentication, no user interaction, and no attempt limits mean any reachable instance can be brute-forced. Real risk depends on exposure; internet-facing or flat-network devices with weak passwords are most at risk. No active exploitation, KEV listing, public exploit, or scanner template is known. Overall risk is medium for exposed deployments and low for properly segmented ones. AI/ML-specific risk is low.

How does the attack unfold?

Discovery

Attacker finds boneIO Black devices with the web interface or SSH reachable from the network or internet.

AML.T0006

Initial Access

Unlimited brute-force attempts against POST /api/login or SSH recover a weak password.

AML.T0012

Control

Attacker logs in and changes configuration or opens a shell on the controller.

Impact

Device is taken over and used to manipulate connected systems or pivot into the local network.

Discovery

Attacker finds boneIO Black devices with the web interface or SSH reachable from the network or internet.

AML.T0006

Initial Access

Unlimited brute-force attempts against POST /api/login or SSH recover a weak password.

AML.T0012

Control

Attacker logs in and changes configuration or opens a shell on the controller.

Impact

Device is taken over and used to manipulate connected systems or pivot into the local network.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade boneIO Black to version 1.6.0 or later. 2) Set strong, unique passwords of at least 8 characters, and prefer long passphrases or SSH keys. 3) Do not expose the web interface (POST /api/login) or SSH to the internet; restrict access via VPN, firewall rules, or VLAN segmentation. 4) Monitor for bursts of failed logins on /api/login and for repeated SSH authentication failures; alert on many attempts from one source. 5) Add network-level rate limiting or fail2ban-style controls in front of the device until patched. 6) Rotate credentials on any device that was reachable before patching.

How is it classified?

Auth BypassFrameworkAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage identified risks

Frequently Asked Questions

What is CVE-2026-77057?

boneIO Black, a home and building automation controller, does not rate-limit login attempts on its web interface (POST /api/login) or SSH service and does not enforce password complexity, so an unauthenticated remote attacker can guess credentials indefinitely. This is a conventional IoT weakness (CWE-307) rather than an AI-specific attack, and the AI relevance is tenuous: the device is classified as an ML UI component but has no tracked AI package, no known downstream dependents, and no stated AI function. There is no CVSS or EPSS score yet, it is not in CISA KEV, and no public exploit or Nuclei template exists, so near-term exploitation signals are absent, though brute-forcing is trivial to automate against any exposed instance. Upgrade to boneIO Black 1.6.0 or later, which adds per-source and per-account rate limiting, an 8-character minimum password, and tighter SSH attempt limits. Until then, keep the device off the internet and behind a VPN or network segment, and rotate any weak passwords.

Is CVE-2026-77057 actively exploited?

No confirmed active exploitation of CVE-2026-77057 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77057?

1) Upgrade boneIO Black to version 1.6.0 or later. 2) Set strong, unique passwords of at least 8 characters, and prefer long passphrases or SSH keys. 3) Do not expose the web interface (POST /api/login) or SSH to the internet; restrict access via VPN, firewall rules, or VLAN segmentation. 4) Monitor for bursts of failed logins on /api/login and for repeated SSH authentication failures; alert on many attempts from one source. 5) Add network-level rate limiting or fail2ban-style controls in front of the device until patched. 6) Rotate credentials on any device that was reachable before patching.

What systems are affected by CVE-2026-77057?

This vulnerability affects the following AI/ML architecture patterns: IoT/edge controllers, Building and home automation systems, Device management web interfaces.

What is the CVSS score for CVE-2026-77057?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

IoT/edge controllersBuilding and home automation systemsDevice management web interfaces

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access to the device. This issue was fixed in version 1.6.0: web login attempts are rate-limited per source address and per account, panel passwords must be at least 8 characters long, and SSH allows three authentication attempts per connection with a shortened login grace time.

Exploitation Scenario

An attacker scans for reachable boneIO Black devices and finds one with its web interface or SSH exposed. They run a credential-guessing tool against POST /api/login or SSH using common and default passwords, and the lack of rate limiting lets them try thousands of combinations without lockout. Once a weak password is found, they log in, change device configuration or open a shell, and use the controller as a foothold to reach other devices on the network, including systems hosting AI-enabled automation.

Weaknesses (CWE)

CWE-307Improper Restriction of Excessive Authentication AttemptsPrimary CWE-307Improper Restriction of Excessive Authentication Attempts

CWE-307 — Improper Restriction of Excessive Authentication Attempts: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

[Architecture and Design] Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Source: MITRE CWE corpus.