boneIO Black versions prior to 1.6.0 do not limit authentication attempts on their web interface or SSH service and lack password complexity enforcement. This allows unauthenticated remote attackers to perform unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access. The issue was fixed in version 1.6.0 by implementing rate limiting on web login attempts, enforcing a minimum password length of 8 characters, and restricting SSH authentication attempts to three per connection with a shortened login grace time.