boneIO Black versions prior to 1.6.0 expose an unauthenticated Node-RED instance at the /nodered/ path via a Caddy reverse proxy. This Node-RED Admin API allows deployment of flows capable of executing arbitrary system commands. An unauthenticated attacker on the local network can exploit this to deploy malicious flows, resulting in remote code execution and full control over the home automation system. The vulnerability is fixed in version 1.6.0.