boneIO Black fails to enforce limits on authentication attempts on its web interface (POST /api/login) and its SSH service, and it does not require robust password complexity. This deficiency permits an unauthenticated attacker to perform unlimited brute‑force login attempts, potentially compromising user accounts and allowing unauthorized control of the device. The vulnerability is an example of improper restriction of authentication attempts, classified as CWE-307.

The affected vendor is boneIO and the product is boneIO Black. All versions prior to 1.6.0 are vulnerable as the issue was fixed in that release. Users relying on the default web interface or SSH service before the 1.6.0 update should consider their installations exposed.

The CVSS score is 2.3, indicating low severity, and there is no EPSS score available. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it remotely without authentication over the network, using either the web interface or SSH; no special conditions or privileged access are required. Since brute‑force attempts are unlimited, successful compromise is strongly likely if no additional controls are in place. The lack of rate limiting creates an attack surface that, while low risk overall, remains exploitable for credential theft or device hijacking.