boneIO's Black product contains multiple API endpoints that omit authentication checks. An unauthenticated remote attacker with local network access can freely query these routes to obtain system logs, firmware revision, serial number, MQTT username, configuration file listings, and the full API documentation. This disclosure facilitates reconnaissance and can support subsequent targeted attacks against the device. The flaw is identified as a missing authentication weakness, CWE‑306.

All boneIO installations running firmware versions older than 1.6.0 are affected. The vendor released a fix in release 1.6.0 wherein every API route now requires an authenticated role, the interactive API documentation is blocked, and the serial number is hidden from anonymous callers. Thus, devices still deployed on earlier firmware are susceptible until updated.

The CVSS score of 5.3 indicates a moderate risk. Because the EPSS score is not available, the likelihood of exploitation cannot be quantified, but the vulnerability is locally exploitable over the network. It is not listed in the CISA KEV catalog, suggesting no widespread exploits are reported yet. An attacker would simply need to send HTTP requests to the exposed endpoints from any system that can reach the device over the local network.