Vendor
boneIO
11 known vulnerabilities.
Products
4 results · Clear filters · Feed
-
High 8.8
TOCTOU Race Condition in boneIO
boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privile…
-
High 7.1
Use of Default Credentials in boneIO
boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use …
-
High 8.7
Missing Authentication in Default Configuration in boneIO
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing den…
-
High 8.7
Missing Authentication for Node-RED in boneIO
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can…