boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes every endpoint without credentials. The vulnerability allows an unauthenticated remote attacker to gain full control of the device, which can result in denial‑of‑service, configuration changes, and manipulation of connected physical circuits. The weakness is missing authentication (CWE‑306).

Any boneIO device running firmware versions older than 1.6.0 is vulnerable. Versions up to 1.5.x ship with Debian 10 and are no longer supported, so affected devices should be re‑flashed with the 1.6.0 system image. The vulnerability applies to the boneIO product from boneIO.

The CVSS score is 8.7 indicating high severity. No EPSS score is publicly available, but the lack of a published exploit probability does not reduce the risk because the attack vector is network‑based and the service is exposed on all interfaces. The vulnerability is not listed in the CISA KEV catalog, but the exposed API makes it an attractive target for attackers. An attacker can obtain full device control by sending unauthenticated requests to any API endpoint.