Security

boneIO Black controls the lights, blinds and heating in your home, so we take its security seriously. We do everything we can to make it as secure a controller as you can install: secure from the first start, kept up to date, and open about its own flaws.

This work is part of adapting boneIO Black to the requirements of the EU Cyber Resilience Act (CRA). The rules are in the security policy.

What we do on our side

• Secure from the first start. The panel is served over HTTPS only, you create the administrator account yourself in the wizard, and new controllers share no passwords: the MQTT broker password is random on every device and there is no factory SSH password.
• Sign-in protection. A limit on sign-in attempts in the panel and over SSH, a minimum password length, and protection against commands sent from other sites (CSRF) and against framing the panel.
• Updates for the whole system. You update Debian, the kernel and boneIO from the panel, and system security fixes install themselves once a day — System. System changes reach the controller through signed migrations.
• The controller tells you what is open. The Security page in the panel lists what is worth fixing on your controller, with a Fix button. The same information goes to Home Assistant.
• Independent reviews and openness. We treat reports from researchers as help. Every vulnerability that gets a CVE ID is published below, together with what to do on your controller.

What we recommend for your network

Even the best-secured controller is only as secure as the network it runs in.

• A separate network for automation (VLAN). Put the boneIO controllers and Home Assistant in their own network or VLAN, apart from computers, phones and guests. From your home network allow only what you need: the panel (8443), and SSH (22) for the administrator. Home Assistant connects to the MQTT broker on the controller on port 1883 (8883 with TLS). mDNS scanning does not cross VLANs, so add remote devices by IP address.
• Do not expose the controller to the internet. No port forwarding on the router. For remote access use Home Assistant or a VPN (for example WireGuard or Tailscale).
• Internet access only for updates. The controller works without the internet (it can take the time from an NTP server in your network), but without it it cannot download updates. If your automation network blocks the internet, let the controller go out to the internet at least for updates, or unblock it while you update. In the second case automatic security fixes do not arrive on their own, so update manually and regularly.
• Clear the "Outstanding" list. In the panel: Settings → Access → Security.
• Keep it updated. Leave automatic security fixes on and install new boneIO versions from Settings → Maintenance. Make a backup before updating.
• Separate accounts. Give household members read-only accounts: they control the installation but cannot change the configuration.
• Get rid of the certificate warning. Someone who clicks "proceed anyway" every day will not notice a real attack. See HTTPS certificate.
• Encrypt MQTT beyond the controller. If boneIO connects to a broker over a shared network, a VPN or the internet, turn on TLS.

Security advisories

Every boneIO Black vulnerability that has a CVE ID is published here: which versions it affects, which version fixes it, and whether you have to do anything beyond updating. Newest first.

October 2026 — review of version 1.5.0 (CERT Polska)

An independent security review of boneIO Black 1.5.0 was disclosed in coordination with CERT Polska on 26 October 2026: CERT Polska notice. All vulnerabilities are fixed in 1.6.0. Thanks to Mateusz Włodarczak (s3ga) for the report.

What to do

1. Update the application to the latest 1.6.x. From 1.5, go to 1.5.6 first, then follow the checklist.
2. Create an administrator account in the wizard that appears after the update. Until then the controller refuses API requests.
3. Change the MQTT broker password if the controller was updated rather than freshly flashed. The update deliberately leaves it alone so the connection to Home Assistant does not break. The panel reports it under Settings → Access → Security, and Fix takes you to the change. Then enter the new password in Home Assistant.
4. Change the SSH password if it is still the factory one — SSH login password.
5. Controllers older than 1.2.0 (Debian 10) cannot be updated. Flash a 1.6 system image — upgrading to Debian 13.

Vulnerabilities

The system image fixes (77055, 77056, 77060) reach an updated controller through signed system migrations — except the MQTT password, which you change yourself. What exactly changed in 1.6.0: release notes.

Reporting a vulnerability

Please do not open a public issue. Use private reporting on GitHub or email security@boneio.eu with SECURITY in the subject. We acknowledge within 5 working days. You can also report through CERT Polska.