Four vulnerabilities published on 26 October affect boneIO Black, an open-source DIN-rail controller used for industrial and building automation, and one of them is critical. CVE-2026-77053 (CVSS 4.0 8.7) is the most consequential: the firmware ships with authentication disabled and its management web API listens on all network interfaces, so an unauthenticated attacker on the network can take full control of the device — causing denial of service, changing configuration and operating the physical circuits wired to it. CVE-2026-77055 is rated 9.3 Critical: the Debian image grants the boneio service account passwordless sudo and docker-group membership, so anything that compromises that account escalates straight to root. CVE-2026-77052 exposes a Node-RED instance without authentication through a Caddy reverse proxy, allowing an attacker to deploy a flow that executes arbitrary system commands, and CVE-2026-77059 is a TOCTOU race in the timezone sudoers helper where a predictable temporary file is validated and then installed with root privileges. All four are fixed in boneIO 1.6.0, and the maintainer notes devices already in the field have the sudoers rule and docker membership removed when the image is sealed. The pattern — consumer-grade defaults on a device that switches real-world circuits — is the recurring failure mode of low-cost OT kit.

• Source article