Technical documentation often encodes implicit indicators of device behavior and design choices that can correlate with security weaknesses. This paper introduces a specification-driven framework that automatically extracts such indicators from technical documentation to predict the presence of vulnerabilities in IoT devices. We convert textual specifications into features using TF-IDF and BM25, then evaluate XGBoost and Random Forest classifiers on a corpus of 1,521 documents spanning vulnerable IoT devices, non-vulnerable IoT devices, and non-IoT products. XGBoost achieved the best performance (accuracy 95.1%, precision 95.4%, recall 95.1%) with TF-IDF and BM25 yielding near-equivalent results, indicating stable, recurring specification patterns associated with vulnerable devices. These findings show that specification-derived signals can serve as an effective, scalable early-warning mechanism to prioritize devices for targeted security assessment, complementing vulnerability repositories such as the NVD.