Passwords for the MQTT broker, web panel, and other services are stored in cleartext (CWE‑312) and the /api/config endpoint exposes them in the response to any authenticated user. As a result, anyone able to authenticate to the device can obtain full administrative credentials, and due to a separate defect that leaves authentication disabled by default, an attacker on the same local network can read these secrets without authentication. This exposure enables credential theft, privilege escalation, and full compromise of the device, as the attacker gains both the ability to control the MQTT broker and the web interface.

boneIO devices running versions prior to 1.6.0 are affected. The vulnerable configuration includes the web panel, MQTT broker, and any sub‑services for which passwords are stored directly in configuration files and can be retrieved via the API.

The CVSS score of 6.9 indicates moderate severity, and while the EPSS score is not available, the fact that the vulnerability can be exploited without authentication on the same local network elevates its practical risk. The issue is not listed in the CISA KEV catalog, but attackers could leverage the exposed credentials to take full control of the device and any systems the device communicates with.