CVE-2026-77052
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 26, 2026
Vendor
unknown
Description
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system. This issue was fixed in version 1.6.0.