Medium severity · published Oct 26, 2026
CVE-2026-77060
Incorrect Permission Assignment for Critical Resource in boneIO
New
6.8
CVSS
0.1%
EPSS
No
On KEV
Description
boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks.
This issue was fixed in version 1.6.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
black_debian_images · boneIO
1.2.0 before 1.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77060
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77060
boneio.eu
https://boneio.eu/en/docs/black
cert.pl
https://cert.pl/en/posts/2026/10/CVE-2026-77052
More from black_debian_images
9.3
CVE-2026-77055
Improper Privilege Assignment in boneIO
7.1
CVE-2026-77056
Use of Default Credentials in boneIO