securityblackesphome

boneIO security: CVEs for boneIO Black and new boneIO ESP firmware

What CERT Polska published, what we fixed in boneIO Black 1.6, and what changes in boneIO ESP firmware.

• Pawel
Back
boneIO Black: 11 vulnerabilities published by CERT PolskaboneIO ESP: updates from Home Assistant and safer firmwareIf you find a vulnerability

Hi! This time it is about security, for both product lines at once: boneIO Black and boneIO ESP. We are adapting both controllers to the requirements of the EU Cyber Resilience Act (CRA) — the regulation that, from this year, puts obligations on manufacturers around vulnerability handling and updates. Below: what happened, what we changed, and what to do on your controller.

boneIO Black: 11 vulnerabilities published by CERT Polska

On 26 October CERT Polska published 11 vulnerabilities (CVE-2026-77052 – CVE-2026-77062) found in an independent security review of boneIO Black 1.5.0. They were reported by Mateusz Włodarczak (s3ga) — thank you! The disclosure was coordinated: all of them were fixed in version 1.6.0 before they were published.

In short, they concerned:

  • the panel and its API required no sign-in by default, and Node-RED was reachable without signing in;
  • the API returned stored passwords, and sign-in had no limit on attempts;
  • another website could send commands to the controller (CSRF) or frame the panel (clickjacking);
  • in the system image: too broad privileges for the service account, the same default MQTT broker password on every controller, and an MQTT password file readable by every account.

In the 1.6 series the panel works only with an administrator account created at first start, has roles and sign-in limits, never returns passwords, refuses requests from other sites, and privileged operations go through a closed set of tools and signed migrations. New controllers have no shared passwords at all.

What to do:

  1. Update the controller to the latest 1.6.x (from 1.5 — go to 1.5.6 first).
  2. If the controller was updated rather than freshly flashed, change the MQTT broker password — the panel shows it under Settings → Access → Security.
  3. Change the SSH password if it is still the factory one.
  4. Controllers older than 1.2.0 (Debian 10) need a new system image.

All details and the full list: boneIO Black security advisories.

boneIO ESP: updates from Home Assistant and safer firmware

The latest boneIO ESP firmware changes how controllers get fixes, and closes several things that were open until now.

  • Updates straight from Home Assistant. The controller has a Firmware entity — when we release a new version, you install it with one click. No ESPHome Builder, no cable.
  • Encrypted connection to Home Assistant. On its first connection Home Assistant sets its own unique key on the controller. From then on nobody on the network can read the connection or switch outputs through it.
  • No device web page by default. The controller's web page has no password, so factory firmware ships without it. If you need it, pick the + web panel option in the installer.
  • No firmware upload through the browser.
  • Dimmer gen2: operating mode from Home Assistant. Switch it between 8 channels, 2× RGBW and 4× CCT — Home Assistant shows it as an update to install.

To be clear about what factory firmware does not close: firmware upload over the network (ESPHome OTA) has no password — ESPHome requires it, because that is how you install your own configuration after adoption. Keep the controller on a trusted network, and to close this too, adopt it in ESPHome Builder and turn on OTA encryption.

What to do: controllers you already have get these features after flashing firmware once from boneio.eu/esp (USB cable). Accept erasing the device during installation, then add the controller to Home Assistant. Later versions arrive through the Firmware entity. Models no longer sold (24x16, Dimmer v0.3) keep getting firmware.

Controllers adopted in ESPHome Builder do not have this channel — you update them yourself by compiling the configuration. How to secure them: boneIO ESP security.

If you find a vulnerability

Email security@boneio.eu with SECURITY in the subject, use private reporting on GitHub, or report through CERT Polska. We acknowledge within 5 working days. The rules are in the security policies of boneIO Black and boneIO ESP — for ESP, problems in ESPHome itself (an Open Home Foundation project) are passed on to its developers.