PT-2026-123365

CVE-2026-77060

·

Published

2026-10-26

·

Updated

2026-10-26

Description by

CVSS 4.0
6.8
Medium
MetricsAV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
boneIO black debian images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks.
This issue was fixed in version 1.6.0.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-732: Incorrect Permission Assignment for Critical Resource
Related identifiers
CVE-2026-77060
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com