boneIO Black exposes all state‑changing API endpoints to Cross‑Site Request Forgery because the firmware does not issue CSRF tokens and does not check Origin or Referer headers. A remote attacker can host a malicious web page; when an internal user visits it an automated request is sent to the device, allowing the attacker to reboot, toggle relays, control gates or blinds, and even shut the device down. This results in loss of device integrity and availability. The problem is compounded by a related issue that leaves authentication disabled by default, giving any local network user the ability to perform these actions without credentials.

The vulnerability affects boneIO devices running firmware versions earlier than 1.6.0. All installations of the boneIO Black platform are potentially impacted unless they have been updated to version 1.6.0 or later.

The CVSS score of 5.1 indicates a medium potential impact. Exploitation requires a user on the internal network to be induced to visit a malicious site, so the attack vector is internal user confusion or phishing. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting that widespread active exploitation is not yet documented. However, the impact on control systems and the relative ease of triggering the attack means the risk remains significant for environments where the firmware is outdated or authentication is disabled.