iobroker Webseite http://IP:8081 funktioniert nicht mehr
-
Da habe ich zu schnell geschossen. Es liegt offenbar an Firefox. Muss an einem Update liegen. Mit dem sonst nicht von mir verwendeten Edge funktioniert es.
-
Ich habe den iobroker auf einem Raspi4 unter Bookworm laufen (kein Docker). Er läuft auch und die Blockly Skripte arbeiten. Aber ich komme nicht mehr auf die Webseite. Beim Aufruf erscheint das blaue "io" Logo, das sich dreht. Leider hört es damit nicht mehr auf.
Habe schon mal über Putty ein fix und update laufen lassen, das hilft aber nicht. Ich habe außer an den Blockly Skripten seit Monaten nichts mehr an dem System gemacht...Hat jemand eine Idee für mich was das sein könnte und wie ich weiter vorgehen könnte?
Gruß purehunter
seit Monaten nichts mehr an dem System gemacht...
Solltest du aber. Updates müssen regelmäßig eingespielt werden, nicht 'alle paar Monate'.
-
Da habe ich zu schnell geschossen. Es liegt offenbar an Firefox. Muss an einem Update liegen. Mit dem sonst nicht von mir verwendeten Edge funktioniert es.
purehunter sagte:
Es liegt offenbar an Firefox. Muss an einem Update liegen.
Genau aus diesem Grund bin ich mit Updates eher sparsam...
-
purehunter sagte:
Es liegt offenbar an Firefox. Muss an einem Update liegen.
Genau aus diesem Grund bin ich mit Updates eher sparsam...
Falscher Ansatz.
Der Firefox 150.0.1 (64-Bit) funktioniert im Übrigen hier einwandfrei. -
purehunter sagte:
Es liegt offenbar an Firefox. Muss an einem Update liegen.
Genau aus diesem Grund bin ich mit Updates eher sparsam...
Und dein Debian 12 'Bookworm' wirst du auch langsam mal auf das aktuelle Release hieven müssen, im Sommer ist Schluss mit dem Bücherwurm.
-
Falscher Ansatz.
Der Firefox 150.0.1 (64-Bit) funktioniert im Übrigen hier einwandfrei.Der Firefox 150.0.1 (64-Bit) funktioniert im Übrigen hier einwandfrei.
Oh. Den verwende ich auch. Und an dem habe ich auch nichts gemacht, außer die automatischen Updates. Seltsam.
-
Der Firefox 150.0.1 (64-Bit) funktioniert im Übrigen hier einwandfrei.
Oh. Den verwende ich auch. Und an dem habe ich auch nichts gemacht, außer die automatischen Updates. Seltsam.
-
Und dein Debian 12 'Bookworm' wirst du auch langsam mal auf das aktuelle Release hieven müssen, im Sommer ist Schluss mit dem Bücherwurm.
Und dein Debian 12 'Bookworm' wirst du auch langsam mal auf das aktuelle Release hieven müssen, im Sommer ist Schluss mit dem Bücherwurm.
Danke für den Hinweis! Die Diagnose vorhin hatte mich auch darauf hingewiesen, aber das "Enddatum" war mir nicht klar.
Da gab es den von mir beachteten Hinweis, dass einiges nicht auf dem neuesten Stand ist... -
Und dein Debian 12 'Bookworm' wirst du auch langsam mal auf das aktuelle Release hieven müssen, im Sommer ist Schluss mit dem Bücherwurm.
Danke für den Hinweis! Die Diagnose vorhin hatte mich auch darauf hingewiesen, aber das "Enddatum" war mir nicht klar.
Da gab es den von mir beachteten Hinweis, dass einiges nicht auf dem neuesten Stand ist...Danke für den Hinweis! Die Diagnose vorhin hatte mich auch darauf hingewiesen, aber das "Enddatum" war mir nicht klar.
Dann zeig den Output mal. Das EOL ist wohl auch noch nicht ganz fix terminiert, bislang steht der 10.06.2026 im Plan.
-
========== Start marking the full check here ===========
Script v.2026-01-31 *** BASE SYSTEM *** Operating System: Debian GNU/Linux 12 (bookworm) Static hostname: iobroker Icon name: computer Kernel: Linux 6.12.47+rpt-rpi-v8 Architecture: arm64 OS is similar to: Model : Raspberry Pi 4 Model B Rev 1.5 Docker : false Virtualization : none Kernel : aarch64 Userland : 64 bit Systemuptime and Load: 17:55:56 up 3:08, 2 users, load average: 0.95, 0.70, 0.55 CPU threads: 4 *** LIFE CYCLE STATUS *** Debian 'bookworm' is the current oldstable version. Please upgrade to the latest stable release 'trixie' in due time! *** RASPBERRY THROTTLING *** Current issues: No throttling issues detected. Previously detected issues: ~ Under-voltage has occurred ~ Arm frequency capping has occurred ~ Throttling has occurred ~ Soft temperature limit has occurred *** TIME AND TIMEZONES *** Local time: Thu 2026-05-07 17:55:57 CEST Universal time: Thu 2026-05-07 15:55:57 UTC RTC time: n/a Time zone: Europe/Berlin (CEST, +0200) System clock synchronized: yes NTP service: active RTC in local TZ: no *** Users and Groups *** User that called 'iob diag': rubricappula HOME=/home/rubricappula GROUPS=rubricappula adm dialout cdrom sudo audio video plugdev games users input render netdev gpio i2c spi iobroker User that is running 'js-controller': iobroker HOME=/home/iobroker GROUPS=iobroker tty dialout audio video plugdev bluetooth gpio i2c rubricappula *** DISPLAY-SERVER SETUP *** Display-Server: false Unit display-manager.service could not be found. Display-Manager: Desktop: Session: tty *** MEMORY *** total used free shared buff/cache available Mem: 4.0G 1.5G 1.3G 1.2M 1.2G 2.5G Swap: 536M 0B 536M Total: 4.5G 1.5G 1.8G Active iob-Instances: 18 3796 M total memory 1430 M used memory 1453 M active memory 833 M inactive memory 1239 M free memory 155 M buffer memory 1026 M swap cache 511 M total swap 0 M used swap 511 M free swap *** top - Table Of Processes *** top - 17:55:58 up 3:09, 2 users, load average: 0.95, 0.70, 0.55 Tasks: 196 total, 1 running, 195 sleeping, 0 stopped, 0 zombie %Cpu(s): 0.0 us, 20.0 sy, 0.0 ni, 80.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st MiB Mem : 3796.9 total, 1239.2 free, 1431.3 used, 1182.0 buff/cache MiB Swap: 512.0 total, 512.0 free, 0.0 used. 2365.5 avail Mem *** FAILED SERVICES *** UNIT LOAD ACTIVE SUB DESCRIPTION 0 loaded units listed. *** DMESG CRITICAL ERRORS *** No critical errors detected *** FILESYSTEM *** Filesystem Type Size Used Avail Use% Mounted on udev devtmpfs 1.6G 0 1.6G 0% /dev tmpfs tmpfs 760M 1.2M 759M 1% /run /dev/mmcblk0p2 ext4 59G 7.1G 49G 13% / tmpfs tmpfs 1.9G 0 1.9G 0% /dev/shm tmpfs tmpfs 5.0M 16K 5.0M 1% /run/lock /dev/mmcblk0p1 vfat 510M 65M 446M 13% /boot/firmware /dev/sda1 ext4 229G 87M 217G 1% /media/usbstick tmpfs tmpfs 380M 4.0K 380M 1% /run/user/1000 Messages concerning ext4 filesystem in dmesg: [Thu May 7 14:46:58 2026] EXT4-fs (mmcblk0p2): mounted filesystem ce208fd3-38a8-424a-87a2-cd44114eb820 ro with ordered data mode. Quota mode: none. [Thu May 7 14:46:59 2026] EXT4-fs (mmcblk0p2): re-mounted ce208fd3-38a8-424a-87a2-cd44114eb820 r/w. [Thu May 7 14:47:03 2026] EXT4-fs (sda1): mounted filesystem f489659f-9e85-475e-acdb-bd41a376d459 r/w with ordered data mode. Quota mode: none. Show mounted filesystems: TARGET SOURCE FSTYPE OPTIONS / /dev/mmcblk0p2 ext4 rw,noatime |-/boot/firmware /dev/mmcblk0p1 vfat rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,errors=remount-ro `-/media/usbstick /dev/sda1 ext4 rw,relatime Files in neuralgic directories: /var: 1.7G /var/ 712M /var/log 711M /var/log/journal/3d8e106f2bf442a68272568227ba4c48 711M /var/log/journal 262M /var/cache Archived and active journals take up 710.8M in the file system. /opt/iobroker/backups: 4.0M /opt/iobroker/backups/ /opt/iobroker/iobroker-data: 255M /opt/iobroker/iobroker-data/ 184M /opt/iobroker/iobroker-data/files 56M /opt/iobroker/iobroker-data/backup-objects 47M /opt/iobroker/iobroker-data/files/admin.admin 46M /opt/iobroker/iobroker-data/files/admin.admin/custom/assets The five largest files in iobroker-data are: 30M /opt/iobroker/iobroker-data/files/notification-manager.admin/build/index.js.map 11M /opt/iobroker/iobroker-data/files/notification-manager.admin/build/index.js 9.1M /opt/iobroker/iobroker-data/objects.jsonl 8.2M /opt/iobroker/iobroker-data/files/modbus.admin/assets/index-6vd4TbNS.js 6.1M /opt/iobroker/iobroker-data/states.jsonl USB-Devices by-id: USB-Sticks - Avoid direct links to /dev/tty* in your adapter setups, please always prefer the links 'by-id': /dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0 *** ZigBee Settings *** ⚠ HINT: Your zigbee.0 COM-Port is NOT matching 'by-id'. Please check your setting: /dev/ttyUSB0 Zigbee Network Settings on your coordinator/in nvbackup are: zigbee.X Extended Pan ID: *** MASKED *** Pan ID: *** MASKED *** Channel: *** MASKED *** Network Key: *** MASKED *** To unmask the settings run 'iob diag --unmask' *** NodeJS-Installation *** /usr/bin/nodejs v22.21.1 /usr/bin/node v22.21.1 /usr/bin/npm 10.9.4 /usr/bin/npx 10.9.4 ✓ Node.js installation is correct nodejs: Installed: 22.21.1-1nodesource1 Candidate: 22.22.2-1nodesource1 Version table: 22.22.2-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.22.1-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.22.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages *** 22.21.1-1nodesource1 100 100 /var/lib/dpkg/status 22.21.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.20.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.19.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.18.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.17.1-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.17.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.16.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.15.1-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.15.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.14.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.13.1-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.13.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.12.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.11.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.10.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.9.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.8.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.7.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.6.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.5.1-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.5.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.4.1-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.4.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.3.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.2.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.1.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.0.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 18.20.4+dfsg-1~deb12u1 500 500 http://deb.debian.org/debian bookworm/main arm64 Packages 500 http://deb.debian.org/debian-security bookworm-security/main arm64 Packages Temp directories causing deletion problem: 0 No problems detected Errors in npm tree: 0 No problems detected Checking for nodejs vulnerability: ██████ █████ ███ ██ ██████ ███████ ███████ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ███████ ██ ██ ██ ██ ███ █████ ███████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██████ ██ ██ ██ ████ ██████ ███████ ██ ██ The current Node.js version (v22.21.1) is vulnerable to the following CVEs: CVE-2025-55130(high): A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25. Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0 = CVE-2025-55131(high): A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact. Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0 = CVE-2025-55132(low): A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25. Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0 = CVE-2025-59464(medium): A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service. Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 = CVE-2025-59465(high): A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0 = CVE-2025-59466(medium): We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions. Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0 = CVE-2026-21637(high): A flaw in Node.js TLS error handling leaves `SNICallback` invocations unprotected against synchronous exceptions, while the equivalent ALPN and PSK callbacks were already addressed in CVE-2026-21637. This represents an incomplete fix of that prior vulnerability. When an `SNICallback` throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception, crashing the Node.js process. * This vulnerability affects all Node.js versions that received the CVE-2026-21637 fix, including **20.x, 22.x, 24.x, and 25.x**, on any TLS server where `SNICallback` may throw on unexpected `servername` input. Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2 = CVE-2026-21710(high): A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2 = CVE-2026-21713(medium): A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2 = CVE-2026-21714(medium): A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25. Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2 = CVE-2026-21715(low): A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted. Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2 = CVE-2026-21716(low): An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted. Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2 = CVE-2026-21717(medium): A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2 = *** ioBroker-Installation *** ioBroker Status iobroker is running on this host. Objects type: jsonl States type: jsonl Hosts: iobroker iobroker (version: 7.0.7, hostname: iobroker , alive, uptime: 9485) Core adapters versions js-controller: 7.0.7 admin: 7.8.23 javascript: 9.0.18 nodejs modules from github: 0 Adapter State + system.adapter.admin.0 : admin : iobroker - enabled, port: 8081, bind: 0.0.0.0, run as: admin system.adapter.cloud.0 : cloud : iobroker - disabled + system.adapter.discovery.0 : discovery : iobroker - enabled + system.adapter.email.0 : email : iobroker - enabled + system.adapter.fb-checkpresence.0 : fb-checkpresence : iobroker - enabled + system.adapter.fronius-wattpilot.0 : fronius-wattpilot : iobroker - enabled + system.adapter.fronius.0 : fronius : iobroker - enabled system.adapter.icons-mfd-svg.0 : icons-mfd-svg : iobroker - enabled + system.adapter.jarvis.0 : jarvis : iobroker - enabled, port: 8082, bind: 0.0.0.0, run as: admin + system.adapter.javascript.0 : javascript : iobroker - enabled system.adapter.modbus.0 : modbus : iobroker - disabled + system.adapter.mqtt.0 : mqtt : iobroker - enabled, port: 1883, bind: 0.0.0.0 + system.adapter.notification-manager.0 : notification-manager : iobroker - enabled + system.adapter.ping.0 : ping : iobroker - enabled + system.adapter.sayit.0 : sayit : iobroker - enabled + system.adapter.scenes.0 : scenes : iobroker - enabled + system.adapter.signal-cmb.0 : signal-cmb : iobroker - enabled + system.adapter.sql.0 : sql : iobroker - enabled system.adapter.tuya.0 : tuya : iobroker - disabled + system.adapter.web.0 : web : iobroker - enabled, port: 8082, bind: 0.0.0.0, run as: admin + system.adapter.zigbee.0 : zigbee : iobroker - enabled, port: /dev/ttyUSB0 + instance is alive Enabled adapters with bindings + system.adapter.admin.0 : admin : iobroker - enabled, port: 8081, bind: 0.0.0.0, run as: admin + system.adapter.jarvis.0 : jarvis : iobroker - enabled, port: 8082, bind: 0.0.0.0, run as: admin + system.adapter.mqtt.0 : mqtt : iobroker - enabled, port: 1883, bind: 0.0.0.0 + system.adapter.web.0 : web : iobroker - enabled, port: 8082, bind: 0.0.0.0, run as: admin + system.adapter.zigbee.0 : zigbee : iobroker - enabled, port: /dev/ttyUSB0 ioBroker-Repositories ┌─────────┬──────────┬─────────────────────────────────────────────────────────┬──────────────┐ │ (index) │ name │ url │ auto upgrade │ ├─────────┼──────────┼─────────────────────────────────────────────────────────┼──────────────┤ │ 0 │ 'stable' │ 'http://download.iobroker.net/sources-dist.json' │ false │ │ 1 │ 'beta' │ 'http://download.iobroker.net/sources-dist-latest.json' │ false │ └─────────┴──────────┴─────────────────────────────────────────────────────────┴──────────────┘ Active repo(s): stable Upgrade policy: none Installed ioBroker-Adapters Used repository: stable Adapter "admin" : 7.8.23 , installed 7.8.23 Adapter "cloud" : 5.0.1 , installed 5.0.1 Adapter "discovery" : 5.0.0 , installed 5.0.0 Adapter "email" : 2.0.4 , installed 2.0.4 Adapter "fb-checkpresence": 1.4.2 , installed 1.4.2 Adapter "fronius" : 2.2.0 , installed 2.2.0 Adapter "fronius-wattpilot": 4.8.0, installed 4.8.0 Adapter "icons-mfd-svg": 1.2.0 , installed 1.2.0 Adapter "jarvis" : 3.1.8 , installed 3.1.8 Adapter "javascript" : 9.0.18 , installed 9.0.18 Controller "js-controller": 7.0.7 , installed 7.0.7 Adapter "modbus" : 8.0.3 , installed 8.0.3 Adapter "mqtt" : 6.1.4 , installed 6.1.4 Adapter "notification-manager": 1.3.0, installed 1.3.0 Adapter "ping" : 1.7.9 , installed 1.7.9 Adapter "sayit" : 5.1.0 , installed 5.1.0 Adapter "scenes" : 4.0.4 , installed 4.0.4 Adapter "signal-cmb" : 0.3.0 , installed 0.3.0 Adapter "socketio" : 7.0.8 , installed 6.7.1 [Updatable] Adapter "sql" : 3.0.1 , installed 3.0.1 Adapter "tuya" : 3.17.0 , installed 3.17.0 Adapter "web" : 8.0.0 , installed 7.0.8 [Updatable] Adapter "ws" : 4.0.0 , installed 4.0.0 Adapter "zigbee" : 3.3.5 , installed 3.3.5 Objects and States Please stand by - This may take a while Objects: 3052 States: 2570 *** OS-Repositories and Updates *** Hit:1 http://deb.debian.org/debian bookworm InRelease Hit:2 http://deb.debian.org/debian-security bookworm-security InRelease Hit:3 http://archive.raspberrypi.com/debian bookworm InRelease Hit:4 http://deb.debian.org/debian bookworm-updates InRelease Hit:5 https://deb.nodesource.com/node_22.x nodistro InRelease Reading package lists... Pending systemupdates: 63 *** Listening Ports *** Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN 1001 29004 4259/iobroker.js-co tcp 0 0 127.0.0.1:9001 0.0.0.0:* LISTEN 1001 28999 4259/iobroker.js-co tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 0 5656 541/sshd: /usr/sbin tcp 0 0 0.0.0.0:8400 0.0.0.0:* LISTEN 1001 27617 4547/io.jarvis.0 tcp 0 0 0.0.0.0:1883 0.0.0.0:* LISTEN 1001 29272 4421/io.mqtt.0 tcp6 0 0 :::22 :::* LISTEN 0 5658 541/sshd: /usr/sbin tcp6 0 0 :::8081 :::* LISTEN 1001 29061 4277/io.admin.0 tcp6 0 0 :::8082 :::* LISTEN 1001 29464 4535/io.web.0 udp 0 0 0.0.0.0:57561 0.0.0.0:* 104 6280 415/avahi-daemon: r udp 0 0 0.0.0.0:5353 0.0.0.0:* 104 6278 415/avahi-daemon: r udp6 0 0 :::34259 :::* 104 6281 415/avahi-daemon: r udp6 0 0 fe80::aaa2:76d5:dd5:546 :::* 0 5666 486/NetworkManager udp6 0 0 :::5353 :::* 104 6279 415/avahi-daemon: r *** Log File - Last 25 Lines *** 2026-05-07 17:33:51.645 - info: fronius-wattpilot.0 (4477) Creating WebSocket connection to ws://192.168.10.27/ws 2026-05-07 17:33:51.649 - info: fronius-wattpilot.0 (4477) WebSocket connection closed. Code: 1006, Reason: 2026-05-07 17:33:51.892 - info: fronius-wattpilot.0 (4477) Received HELLO, SSE token: 91100564 2026-05-07 17:33:52.159 - info: fronius-wattpilot.0 (4477) Authentication successful. Connected to Wattpilot. 2026-05-07 17:38:51.273 - info: zigbee.0 (4439) Stopping to ping 0xa4c138503ada269a TS0052 after 4 ping attempts 2026-05-07 17:38:51.645 - warn: fronius-wattpilot.0 (4477) No message received for over 2.5 minutes. Attempting to reconnect. 2026-05-07 17:38:51.647 - info: fronius-wattpilot.0 (4477) Creating WebSocket connection to ws://192.168.10.27/ws 2026-05-07 17:38:51.651 - info: fronius-wattpilot.0 (4477) WebSocket connection closed. Code: 1006, Reason: 2026-05-07 17:38:51.744 - info: fronius-wattpilot.0 (4477) Received HELLO, SSE token: 91100564 2026-05-07 17:38:52.129 - info: fronius-wattpilot.0 (4477) Authentication successful. Connected to Wattpilot. 2026-05-07 17:40:08.172 - info: admin.0 (4277) ==> Connected system.user.admin from ::ffff:192.168.10.70 2026-05-07 17:40:13.021 - info: admin.0 (4277) <== Disconnect system.user.admin from ::ffff:192.168.10.70 2026-05-07 17:40:18.116 - info: admin.0 (4277) ==> Connected system.user.admin from ::ffff:192.168.10.70 2026-05-07 17:40:27.522 - info: host.iobroker stopInstance system.adapter.fronius-wattpilot.0 (force=false, process=true) 2026-05-07 17:40:27.531 - info: fronius-wattpilot.0 (4477) Got terminate signal TERMINATE_YOURSELF 2026-05-07 17:40:27.533 - info: fronius-wattpilot.0 (4477) Shutting down adapter... 2026-05-07 17:40:27.536 - info: fronius-wattpilot.0 (4477) Cleanup complete. Adapter stopped. 2026-05-07 17:40:27.537 - info: fronius-wattpilot.0 (4477) terminating 2026-05-07 17:40:27.538 - info: fronius-wattpilot.0 (4477) Terminated (ADAPTER_REQUESTED_TERMINATION): Without reason 2026-05-07 17:40:27.626 - info: host.iobroker stopInstance system.adapter.fronius-wattpilot.0 send kill signal 2026-05-07 17:40:28.040 - info: fronius-wattpilot.0 (4477) terminating 2026-05-07 17:40:28.136 - info: host.iobroker instance system.adapter.fronius-wattpilot.0 terminated with code 11 (ADAPTER_REQUESTED_TERMINATION) 2026-05-07 17:40:32.015 - info: host.iobroker instance system.adapter.fronius-wattpilot.0 in version "4.8.0" started with pid 9990 2026-05-07 17:40:40.187 - info: admin.0 (4277) <== Disconnect system.user.admin from ::ffff:192.168.10.70 2026-05-07 17:45:00.005 - info: javascript.0 (4288) script.js.common.Produktiv.2025.Lüftung_variabel: Lüftung auf 2============ Mark until here for C&P =============
iob diag has finished.
-
========== Start marking the full check here ===========
Script v.2026-01-31 *** BASE SYSTEM *** Operating System: Debian GNU/Linux 12 (bookworm) Static hostname: iobroker Icon name: computer Kernel: Linux 6.12.47+rpt-rpi-v8 Architecture: arm64 OS is similar to: Model : Raspberry Pi 4 Model B Rev 1.5 Docker : false Virtualization : none Kernel : aarch64 Userland : 64 bit Systemuptime and Load: 17:55:56 up 3:08, 2 users, load average: 0.95, 0.70, 0.55 CPU threads: 4 *** LIFE CYCLE STATUS *** Debian 'bookworm' is the current oldstable version. Please upgrade to the latest stable release 'trixie' in due time! *** RASPBERRY THROTTLING *** Current issues: No throttling issues detected. Previously detected issues: ~ Under-voltage has occurred ~ Arm frequency capping has occurred ~ Throttling has occurred ~ Soft temperature limit has occurred *** TIME AND TIMEZONES *** Local time: Thu 2026-05-07 17:55:57 CEST Universal time: Thu 2026-05-07 15:55:57 UTC RTC time: n/a Time zone: Europe/Berlin (CEST, +0200) System clock synchronized: yes NTP service: active RTC in local TZ: no *** Users and Groups *** User that called 'iob diag': rubricappula HOME=/home/rubricappula GROUPS=rubricappula adm dialout cdrom sudo audio video plugdev games users input render netdev gpio i2c spi iobroker User that is running 'js-controller': iobroker HOME=/home/iobroker GROUPS=iobroker tty dialout audio video plugdev bluetooth gpio i2c rubricappula *** DISPLAY-SERVER SETUP *** Display-Server: false Unit display-manager.service could not be found. Display-Manager: Desktop: Session: tty *** MEMORY *** total used free shared buff/cache available Mem: 4.0G 1.5G 1.3G 1.2M 1.2G 2.5G Swap: 536M 0B 536M Total: 4.5G 1.5G 1.8G Active iob-Instances: 18 3796 M total memory 1430 M used memory 1453 M active memory 833 M inactive memory 1239 M free memory 155 M buffer memory 1026 M swap cache 511 M total swap 0 M used swap 511 M free swap *** top - Table Of Processes *** top - 17:55:58 up 3:09, 2 users, load average: 0.95, 0.70, 0.55 Tasks: 196 total, 1 running, 195 sleeping, 0 stopped, 0 zombie %Cpu(s): 0.0 us, 20.0 sy, 0.0 ni, 80.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st MiB Mem : 3796.9 total, 1239.2 free, 1431.3 used, 1182.0 buff/cache MiB Swap: 512.0 total, 512.0 free, 0.0 used. 2365.5 avail Mem *** FAILED SERVICES *** UNIT LOAD ACTIVE SUB DESCRIPTION 0 loaded units listed. *** DMESG CRITICAL ERRORS *** No critical errors detected *** FILESYSTEM *** Filesystem Type Size Used Avail Use% Mounted on udev devtmpfs 1.6G 0 1.6G 0% /dev tmpfs tmpfs 760M 1.2M 759M 1% /run /dev/mmcblk0p2 ext4 59G 7.1G 49G 13% / tmpfs tmpfs 1.9G 0 1.9G 0% /dev/shm tmpfs tmpfs 5.0M 16K 5.0M 1% /run/lock /dev/mmcblk0p1 vfat 510M 65M 446M 13% /boot/firmware /dev/sda1 ext4 229G 87M 217G 1% /media/usbstick tmpfs tmpfs 380M 4.0K 380M 1% /run/user/1000 Messages concerning ext4 filesystem in dmesg: [Thu May 7 14:46:58 2026] EXT4-fs (mmcblk0p2): mounted filesystem ce208fd3-38a8-424a-87a2-cd44114eb820 ro with ordered data mode. Quota mode: none. [Thu May 7 14:46:59 2026] EXT4-fs (mmcblk0p2): re-mounted ce208fd3-38a8-424a-87a2-cd44114eb820 r/w. [Thu May 7 14:47:03 2026] EXT4-fs (sda1): mounted filesystem f489659f-9e85-475e-acdb-bd41a376d459 r/w with ordered data mode. Quota mode: none. Show mounted filesystems: TARGET SOURCE FSTYPE OPTIONS / /dev/mmcblk0p2 ext4 rw,noatime |-/boot/firmware /dev/mmcblk0p1 vfat rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,errors=remount-ro `-/media/usbstick /dev/sda1 ext4 rw,relatime Files in neuralgic directories: /var: 1.7G /var/ 712M /var/log 711M /var/log/journal/3d8e106f2bf442a68272568227ba4c48 711M /var/log/journal 262M /var/cache Archived and active journals take up 710.8M in the file system. /opt/iobroker/backups: 4.0M /opt/iobroker/backups/ /opt/iobroker/iobroker-data: 255M /opt/iobroker/iobroker-data/ 184M /opt/iobroker/iobroker-data/files 56M /opt/iobroker/iobroker-data/backup-objects 47M /opt/iobroker/iobroker-data/files/admin.admin 46M /opt/iobroker/iobroker-data/files/admin.admin/custom/assets The five largest files in iobroker-data are: 30M /opt/iobroker/iobroker-data/files/notification-manager.admin/build/index.js.map 11M /opt/iobroker/iobroker-data/files/notification-manager.admin/build/index.js 9.1M /opt/iobroker/iobroker-data/objects.jsonl 8.2M /opt/iobroker/iobroker-data/files/modbus.admin/assets/index-6vd4TbNS.js 6.1M /opt/iobroker/iobroker-data/states.jsonl USB-Devices by-id: USB-Sticks - Avoid direct links to /dev/tty* in your adapter setups, please always prefer the links 'by-id': /dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0 *** ZigBee Settings *** ⚠ HINT: Your zigbee.0 COM-Port is NOT matching 'by-id'. Please check your setting: /dev/ttyUSB0 Zigbee Network Settings on your coordinator/in nvbackup are: zigbee.X Extended Pan ID: *** MASKED *** Pan ID: *** MASKED *** Channel: *** MASKED *** Network Key: *** MASKED *** To unmask the settings run 'iob diag --unmask' *** NodeJS-Installation *** /usr/bin/nodejs v22.21.1 /usr/bin/node v22.21.1 /usr/bin/npm 10.9.4 /usr/bin/npx 10.9.4 ✓ Node.js installation is correct nodejs: Installed: 22.21.1-1nodesource1 Candidate: 22.22.2-1nodesource1 Version table: 22.22.2-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.22.1-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.22.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages *** 22.21.1-1nodesource1 100 100 /var/lib/dpkg/status 22.21.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.20.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.19.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.18.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.17.1-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.17.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.16.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.15.1-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.15.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.14.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.13.1-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.13.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.12.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.11.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.10.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.9.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.8.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.7.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.6.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.5.1-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.5.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.4.1-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.4.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.3.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.2.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.1.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 22.0.0-1nodesource1 1001 500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages 18.20.4+dfsg-1~deb12u1 500 500 http://deb.debian.org/debian bookworm/main arm64 Packages 500 http://deb.debian.org/debian-security bookworm-security/main arm64 Packages Temp directories causing deletion problem: 0 No problems detected Errors in npm tree: 0 No problems detected Checking for nodejs vulnerability: ██████ █████ ███ ██ ██████ ███████ ███████ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ███████ ██ ██ ██ ██ ███ █████ ███████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██████ ██ ██ ██ ████ ██████ ███████ ██ ██ The current Node.js version (v22.21.1) is vulnerable to the following CVEs: CVE-2025-55130(high): A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25. Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0 = CVE-2025-55131(high): A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact. Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0 = CVE-2025-55132(low): A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25. Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0 = CVE-2025-59464(medium): A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service. Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 = CVE-2025-59465(high): A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0 = CVE-2025-59466(medium): We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions. Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0 = CVE-2026-21637(high): A flaw in Node.js TLS error handling leaves `SNICallback` invocations unprotected against synchronous exceptions, while the equivalent ALPN and PSK callbacks were already addressed in CVE-2026-21637. This represents an incomplete fix of that prior vulnerability. When an `SNICallback` throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception, crashing the Node.js process. * This vulnerability affects all Node.js versions that received the CVE-2026-21637 fix, including **20.x, 22.x, 24.x, and 25.x**, on any TLS server where `SNICallback` may throw on unexpected `servername` input. Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2 = CVE-2026-21710(high): A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2 = CVE-2026-21713(medium): A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2 = CVE-2026-21714(medium): A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25. Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2 = CVE-2026-21715(low): A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted. Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2 = CVE-2026-21716(low): An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted. Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2 = CVE-2026-21717(medium): A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2 = *** ioBroker-Installation *** ioBroker Status iobroker is running on this host. Objects type: jsonl States type: jsonl Hosts: iobroker iobroker (version: 7.0.7, hostname: iobroker , alive, uptime: 9485) Core adapters versions js-controller: 7.0.7 admin: 7.8.23 javascript: 9.0.18 nodejs modules from github: 0 Adapter State + system.adapter.admin.0 : admin : iobroker - enabled, port: 8081, bind: 0.0.0.0, run as: admin system.adapter.cloud.0 : cloud : iobroker - disabled + system.adapter.discovery.0 : discovery : iobroker - enabled + system.adapter.email.0 : email : iobroker - enabled + system.adapter.fb-checkpresence.0 : fb-checkpresence : iobroker - enabled + system.adapter.fronius-wattpilot.0 : fronius-wattpilot : iobroker - enabled + system.adapter.fronius.0 : fronius : iobroker - enabled system.adapter.icons-mfd-svg.0 : icons-mfd-svg : iobroker - enabled + system.adapter.jarvis.0 : jarvis : iobroker - enabled, port: 8082, bind: 0.0.0.0, run as: admin + system.adapter.javascript.0 : javascript : iobroker - enabled system.adapter.modbus.0 : modbus : iobroker - disabled + system.adapter.mqtt.0 : mqtt : iobroker - enabled, port: 1883, bind: 0.0.0.0 + system.adapter.notification-manager.0 : notification-manager : iobroker - enabled + system.adapter.ping.0 : ping : iobroker - enabled + system.adapter.sayit.0 : sayit : iobroker - enabled + system.adapter.scenes.0 : scenes : iobroker - enabled + system.adapter.signal-cmb.0 : signal-cmb : iobroker - enabled + system.adapter.sql.0 : sql : iobroker - enabled system.adapter.tuya.0 : tuya : iobroker - disabled + system.adapter.web.0 : web : iobroker - enabled, port: 8082, bind: 0.0.0.0, run as: admin + system.adapter.zigbee.0 : zigbee : iobroker - enabled, port: /dev/ttyUSB0 + instance is alive Enabled adapters with bindings + system.adapter.admin.0 : admin : iobroker - enabled, port: 8081, bind: 0.0.0.0, run as: admin + system.adapter.jarvis.0 : jarvis : iobroker - enabled, port: 8082, bind: 0.0.0.0, run as: admin + system.adapter.mqtt.0 : mqtt : iobroker - enabled, port: 1883, bind: 0.0.0.0 + system.adapter.web.0 : web : iobroker - enabled, port: 8082, bind: 0.0.0.0, run as: admin + system.adapter.zigbee.0 : zigbee : iobroker - enabled, port: /dev/ttyUSB0 ioBroker-Repositories ┌─────────┬──────────┬─────────────────────────────────────────────────────────┬──────────────┐ │ (index) │ name │ url │ auto upgrade │ ├─────────┼──────────┼─────────────────────────────────────────────────────────┼──────────────┤ │ 0 │ 'stable' │ 'http://download.iobroker.net/sources-dist.json' │ false │ │ 1 │ 'beta' │ 'http://download.iobroker.net/sources-dist-latest.json' │ false │ └─────────┴──────────┴─────────────────────────────────────────────────────────┴──────────────┘ Active repo(s): stable Upgrade policy: none Installed ioBroker-Adapters Used repository: stable Adapter "admin" : 7.8.23 , installed 7.8.23 Adapter "cloud" : 5.0.1 , installed 5.0.1 Adapter "discovery" : 5.0.0 , installed 5.0.0 Adapter "email" : 2.0.4 , installed 2.0.4 Adapter "fb-checkpresence": 1.4.2 , installed 1.4.2 Adapter "fronius" : 2.2.0 , installed 2.2.0 Adapter "fronius-wattpilot": 4.8.0, installed 4.8.0 Adapter "icons-mfd-svg": 1.2.0 , installed 1.2.0 Adapter "jarvis" : 3.1.8 , installed 3.1.8 Adapter "javascript" : 9.0.18 , installed 9.0.18 Controller "js-controller": 7.0.7 , installed 7.0.7 Adapter "modbus" : 8.0.3 , installed 8.0.3 Adapter "mqtt" : 6.1.4 , installed 6.1.4 Adapter "notification-manager": 1.3.0, installed 1.3.0 Adapter "ping" : 1.7.9 , installed 1.7.9 Adapter "sayit" : 5.1.0 , installed 5.1.0 Adapter "scenes" : 4.0.4 , installed 4.0.4 Adapter "signal-cmb" : 0.3.0 , installed 0.3.0 Adapter "socketio" : 7.0.8 , installed 6.7.1 [Updatable] Adapter "sql" : 3.0.1 , installed 3.0.1 Adapter "tuya" : 3.17.0 , installed 3.17.0 Adapter "web" : 8.0.0 , installed 7.0.8 [Updatable] Adapter "ws" : 4.0.0 , installed 4.0.0 Adapter "zigbee" : 3.3.5 , installed 3.3.5 Objects and States Please stand by - This may take a while Objects: 3052 States: 2570 *** OS-Repositories and Updates *** Hit:1 http://deb.debian.org/debian bookworm InRelease Hit:2 http://deb.debian.org/debian-security bookworm-security InRelease Hit:3 http://archive.raspberrypi.com/debian bookworm InRelease Hit:4 http://deb.debian.org/debian bookworm-updates InRelease Hit:5 https://deb.nodesource.com/node_22.x nodistro InRelease Reading package lists... Pending systemupdates: 63 *** Listening Ports *** Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN 1001 29004 4259/iobroker.js-co tcp 0 0 127.0.0.1:9001 0.0.0.0:* LISTEN 1001 28999 4259/iobroker.js-co tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 0 5656 541/sshd: /usr/sbin tcp 0 0 0.0.0.0:8400 0.0.0.0:* LISTEN 1001 27617 4547/io.jarvis.0 tcp 0 0 0.0.0.0:1883 0.0.0.0:* LISTEN 1001 29272 4421/io.mqtt.0 tcp6 0 0 :::22 :::* LISTEN 0 5658 541/sshd: /usr/sbin tcp6 0 0 :::8081 :::* LISTEN 1001 29061 4277/io.admin.0 tcp6 0 0 :::8082 :::* LISTEN 1001 29464 4535/io.web.0 udp 0 0 0.0.0.0:57561 0.0.0.0:* 104 6280 415/avahi-daemon: r udp 0 0 0.0.0.0:5353 0.0.0.0:* 104 6278 415/avahi-daemon: r udp6 0 0 :::34259 :::* 104 6281 415/avahi-daemon: r udp6 0 0 fe80::aaa2:76d5:dd5:546 :::* 0 5666 486/NetworkManager udp6 0 0 :::5353 :::* 104 6279 415/avahi-daemon: r *** Log File - Last 25 Lines *** 2026-05-07 17:33:51.645 - info: fronius-wattpilot.0 (4477) Creating WebSocket connection to ws://192.168.10.27/ws 2026-05-07 17:33:51.649 - info: fronius-wattpilot.0 (4477) WebSocket connection closed. Code: 1006, Reason: 2026-05-07 17:33:51.892 - info: fronius-wattpilot.0 (4477) Received HELLO, SSE token: 91100564 2026-05-07 17:33:52.159 - info: fronius-wattpilot.0 (4477) Authentication successful. Connected to Wattpilot. 2026-05-07 17:38:51.273 - info: zigbee.0 (4439) Stopping to ping 0xa4c138503ada269a TS0052 after 4 ping attempts 2026-05-07 17:38:51.645 - warn: fronius-wattpilot.0 (4477) No message received for over 2.5 minutes. Attempting to reconnect. 2026-05-07 17:38:51.647 - info: fronius-wattpilot.0 (4477) Creating WebSocket connection to ws://192.168.10.27/ws 2026-05-07 17:38:51.651 - info: fronius-wattpilot.0 (4477) WebSocket connection closed. Code: 1006, Reason: 2026-05-07 17:38:51.744 - info: fronius-wattpilot.0 (4477) Received HELLO, SSE token: 91100564 2026-05-07 17:38:52.129 - info: fronius-wattpilot.0 (4477) Authentication successful. Connected to Wattpilot. 2026-05-07 17:40:08.172 - info: admin.0 (4277) ==> Connected system.user.admin from ::ffff:192.168.10.70 2026-05-07 17:40:13.021 - info: admin.0 (4277) <== Disconnect system.user.admin from ::ffff:192.168.10.70 2026-05-07 17:40:18.116 - info: admin.0 (4277) ==> Connected system.user.admin from ::ffff:192.168.10.70 2026-05-07 17:40:27.522 - info: host.iobroker stopInstance system.adapter.fronius-wattpilot.0 (force=false, process=true) 2026-05-07 17:40:27.531 - info: fronius-wattpilot.0 (4477) Got terminate signal TERMINATE_YOURSELF 2026-05-07 17:40:27.533 - info: fronius-wattpilot.0 (4477) Shutting down adapter... 2026-05-07 17:40:27.536 - info: fronius-wattpilot.0 (4477) Cleanup complete. Adapter stopped. 2026-05-07 17:40:27.537 - info: fronius-wattpilot.0 (4477) terminating 2026-05-07 17:40:27.538 - info: fronius-wattpilot.0 (4477) Terminated (ADAPTER_REQUESTED_TERMINATION): Without reason 2026-05-07 17:40:27.626 - info: host.iobroker stopInstance system.adapter.fronius-wattpilot.0 send kill signal 2026-05-07 17:40:28.040 - info: fronius-wattpilot.0 (4477) terminating 2026-05-07 17:40:28.136 - info: host.iobroker instance system.adapter.fronius-wattpilot.0 terminated with code 11 (ADAPTER_REQUESTED_TERMINATION) 2026-05-07 17:40:32.015 - info: host.iobroker instance system.adapter.fronius-wattpilot.0 in version "4.8.0" started with pid 9990 2026-05-07 17:40:40.187 - info: admin.0 (4277) <== Disconnect system.user.admin from ::ffff:192.168.10.70 2026-05-07 17:45:00.005 - info: javascript.0 (4288) script.js.common.Produktiv.2025.Lüftung_variabel: Lüftung auf 2============ Mark until here for C&P =============
iob diag has finished.
Debian GNU/Linux 12 (bookworm)
Bring es in allernächster Zeit auf 13 'trixie'.
Previously detected issues:
~ Under-voltage has occurred
~ Arm frequency capping has occurred
~ Throttling has occurred
~ Soft temperature limit has occurredDeine Stromversorgung und/oder Kühlung ist zu schwach.
Please check your setting:
/dev/ttyUSB0Trag da im Zigbee-Adapter statt /dev/ttyUSB0 besser
/dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0ein.
Bring dein nodejs auf den aktuellen Stand.
Das ist bei den
Pending systemupdates: 63
schon dabei. System wesentlich regelmäßiger pflegen!Also:
iob update iob upgrade iob stop sudo apt update sudo apt full-upgrade sudo rebootDanach schauen ob es wieder funktioniert.
-
Danke für deine Hinweise!
Die Fehlermeldungen zu Spannung und Temperatur müssen schon älter sein. Das System läuft stabil am original Netzteil in einem Gehäuse mit Lüfter und KK auf den Chips. Das war aber nicht immer so ;-)
Kann man diese Meldungen löschen?
trixie steht auf der todo Liste
-
Danke für deine Hinweise!
Die Fehlermeldungen zu Spannung und Temperatur müssen schon älter sein. Das System läuft stabil am original Netzteil in einem Gehäuse mit Lüfter und KK auf den Chips. Das war aber nicht immer so ;-)
Kann man diese Meldungen löschen?
trixie steht auf der todo Liste
Kann man diese Meldungen löschen?
Erledigt sich mit der Systempflege.
Hey! Du scheinst an dieser Unterhaltung interessiert zu sein, hast aber noch kein Konto.
Hast du es satt, bei jedem Besuch durch die gleichen Beiträge zu scrollen? Wenn du dich für ein Konto anmeldest, kommst du immer genau dorthin zurück, wo du zuvor warst, und kannst dich über neue Antworten benachrichtigen lassen (entweder per E-Mail oder Push-Benachrichtigung). Du kannst auch Lesezeichen speichern und Beiträge positiv bewerten, um anderen Community-Mitgliedern deine Wertschätzung zu zeigen.
Mit deinem Input könnte dieser Beitrag noch besser werden 💗
Registrieren AnmeldenSupport us
289
Online32.9k
Benutzer83.0k
Themen1.3m
Beiträge