CVE-2026-77060
Incorrect Permission Assignment for Critical Resource in boneIO
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks. This issue was fixed in version 1.6.0.
| CWE | CWE-732 |
| Vendor | boneio |
| Product | black_debian_images |
| Published | Oct 26, 2026 |
| Last Updated | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for boneio black_debian_images
Be the first to know when new unknown vulnerabilities affecting boneio black_debian_images are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
boneIO / black_debian_images
1.2.0 < 1.6.0
References
Credits
Mateusz Włodarczak (s3ga)