{"id":"CVE-2026-77057","revision":"6b496ee7aab8476fa1eba67d0fc9582a","records":[{"revision":"6b496ee7aab8476fa1eba67d0fc9582a","observedAt":"2026-10-26T15:35:30.984+00:00","statement":{"source":"cve-program","id":"CVE-2026-77057","aliases":[],"title":"Improper Restriction of Excessive Authentication Attempts in boneIO","description":"boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access to the device.\n\nThis issue was fixed in version 1.6.0: web login attempts are rate-limited per source address and per account, panel passwords must be at least 8 characters long, and SSH allows three authentication attempts per connection with a shortened login grace time.","state":0,"publishedAt":"2026-10-26T14:45:56.237+00:00","modifiedAt":"2026-10-26T14:45:56.237+00:00","affected":[{"ecosystem":"https://pypi.python.org","name":"boneio","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"boneIO\",\n                    \"product\": \"boneIO\",\n                    \"collectionURL\": \"https://pypi.python.org\",\n                    \"packageName\": \"boneio\",\n                    \"repo\": \"https://github.com/boneIO-eu/app_black\",\n                    \"modules\": [\n                        \"app_black\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.2.0\",\n                            \"lessThan\": \"1.6.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","score":2.3,"severity":"LOW"}],"references":["https://cert.pl/en/posts/2026/10/CVE-2026-77052","https://boneio.eu/en/docs/black"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-77057","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-77057","identifiers":["CVE-2026-77057"]},"retained":false,"historicalAffected":[]}],"coverage":[]}