Description
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.
This issue was fixed in version 1.6.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| boneIO | boneIO | 1.3.0 – < 1.6.0 | 1.6.0 |
References
- https://cert.pl/en/posts/2026/10/CVE-2026-77052 third-party-advisory
- https://boneio.eu/en/docs/black product