Description
boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks.
This issue was fixed in version 1.6.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| boneIO | black_debian_images | 1.2.0 – < 1.6.0 | 1.6.0 |
References
- https://cert.pl/en/posts/2026/10/CVE-2026-77052 third-party-advisory
- https://boneio.eu/en/docs/black product