{"id":"CVE-2026-77052","published":"2026-10-26T15:16:42.660","lastModified":"2026-10-26T17:11:35.487","description":"boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.\n\n\nThis issue was fixed in version 1.6.0.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://boneio.eu/en/docs/black","tags":[]},{"url":"https://cert.pl/en/posts/2026/10/CVE-2026-77052","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}