boneIO Black had a vulnerability where several API endpoints were excluded from authentication, allowing unauthenticated remote attackers on the local network to access sensitive information such as system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This information could facilitate reconnaissance and targeted attacks. The issue was fixed in version 1.6.0 by requiring authentication for all API routes, disabling interactive API documentation, and withholding the serial number from anonymous users.