The boneIO Black firmware has a critical security vulnerability where authentication is disabled by default. The management web API listens on all network interfaces and exposes all endpoints without requiring credentials, allowing unauthenticated remote attackers full control over the device. This can lead to denial of service, configuration changes, and manipulation of connected physical circuits. The issue is fixed in version 1.6.0, which enforces administrator account creation and restricts API access to authenticated roles. Versions before 1.2.0 are unsupported and require re-flashing with the fixed system image.