Vulnerability-Lookup

CVE-2026-16454 (GCVE-0-2026-16454)

Vulnerability from cvelistv5 – Published: 2026-07-21 16:38 – Updated: 2026-07-22 18:58

Title

Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration

Summary

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted strictly to the specific firmware artifacts explicitly assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact within the same tenant. This is not an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation. A related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 18:58 UTC

CWE

Assigner

eclipse CNA under the mitre root

CNA scorecard C 66/100 over 204 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/eclipse-hawkbit/hawkbit/securi…
https://gitlab.eclipse.org/security/cve-assignmen…

Impacted products

1 product

Vendor	Product	Version	CPE status
Eclipse Foundation	eclipse-hawkbit/hawkbit	Affected: 0 , ≤ 1.0.3 (custom) Unaffected: 1.0.4 (custom)	guessed

Credits

Santosh Kumar Puppala (GitHub: Santoshkumarpuppala, Email: santhoshkumar7794@gmail.com)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16454",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T18:58:35.078377Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T18:58:48.011Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "eclipse-hawkbit/hawkbit"
          ],
          "product": "eclipse-hawkbit/hawkbit",
          "vendor": "Eclipse Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "1.0.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Santosh Kumar Puppala (GitHub: Santoshkumarpuppala, Email: santhoshkumar7794@gmail.com)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn\u0026nbsp;\u003cb\u003eEclipse hawkBit\u003c/b\u003e\u0026nbsp;versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller.\u003c/p\u003e\u003cp\u003eThis vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted\u0026nbsp;\u003cb\u003estrictly to the specific firmware artifacts explicitly\u003c/b\u003e\u0026nbsp;assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact\u0026nbsp;\u003cb\u003ewithin the same tenant\u003c/b\u003e.\u003c/p\u003e\u003cp\u003eThis is\u0026nbsp;\u003cb\u003enot\u003c/b\u003e\u0026nbsp;an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.\u003c/p\u003e\u003cp\u003eA related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass.\u003c/p\u003e"
            }
          ],
          "value": "In\u00a0Eclipse hawkBit\u00a0versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller.\n\n\n\nThis vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted\u00a0strictly to the specific firmware artifacts explicitly\u00a0assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact\u00a0within the same tenant.\n\n\n\nThis is\u00a0not\u00a0an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.\n\n\n\nA related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T16:38:27.723Z",
        "orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
        "shortName": "eclipse"
      },
      "references": [
        {
          "url": "https://github.com/eclipse-hawkbit/hawkbit/security/advisories/GHSA-92r3-p8c2-3fpx"
        },
        {
          "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/196"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
    "assignerShortName": "eclipse",
    "cveId": "CVE-2026-16454",
    "datePublished": "2026-07-21T16:38:27.723Z",
    "dateReserved": "2026-07-21T10:01:44.585Z",
    "dateUpdated": "2026-07-22T18:58:48.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-16454",
      "date": "2026-11-07",
      "epss": "0.00356",
      "percentile": "0.29562"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "modules": [
                  "eclipse-hawkbit/hawkbit"
                ],
                "product": "eclipse-hawkbit/hawkbit",
                "vendor": "Eclipse Foundation",
                "versions": [
                  {
                    "lessThanOrEqual": "1.0.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "status": "unaffected",
                    "version": "1.0.4",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "emo@eclipse.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:eclipse:hawkbit:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F95073D9-423D-4AF7-9DB9-6D0213E764B1",
                    "versionEndExcluding": "1.0.4",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In\u00a0Eclipse hawkBit\u00a0versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller.\n\n\n\nThis vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted\u00a0strictly to the specific firmware artifacts explicitly\u00a0assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact\u00a0within the same tenant.\n\n\n\nThis is\u00a0not\u00a0an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.\n\n\n\nA related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass."
          },
          {
            "lang": "es",
            "value": "En las versiones 1.0.3 y anteriores de Eclipse hawkBit, se ha identificado una vulnerabilidad de escalada de privilegios (CWE-284 / CWE-862) en el controlador de Integraci\u00f3n Directa de Dispositivos (DDI).\n\nEsta vulnerabilidad permite a un dispositivo autenticado escalar sus permisos y omitir los l\u00edmites estrictos de sus actualizaciones asignadas. En funcionamiento normal, un dispositivo deber\u00eda estar restringido estrictamente a los artefactos de firmware espec\u00edficos que le han sido asignados expl\u00edcitamente. Sin embargo, este fallo permite a cualquier dispositivo autenticado omitir esta restricci\u00f3n y descargar cualquier artefacto de firmware dentro del mismo inquilino.\n\nEsto no es una omisi\u00f3n de autenticaci\u00f3n; el dispositivo solicitante debe poseer credenciales v\u00e1lidas para su inquilino respectivo. En cambio, el problema se deriva de un fallo en la validaci\u00f3n de autorizaci\u00f3n a nivel de objeto.\n\nExiste un problema auxiliar relacionado y de menor gravedad en el punto final de metadatos para listar artefactos de m\u00f3dulos de software. Este punto final no aplica comprobaciones de asignaci\u00f3n, lo que permite a un dispositivo autenticado listar y enumerar artefactos de firmware disponibles, lo que puede facilitar la exfiltraci\u00f3n dirigida utilizando la omisi\u00f3n de autorizaci\u00f3n de descarga principal."
          }
        ],
        "id": "CVE-2026-16454",
        "lastModified": "2026-10-24T19:10:00.127",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "emo@eclipse.org",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-16454",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T18:58:35.078377Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-21T17:17:05.887",
        "references": [
          {
            "source": "emo@eclipse.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/eclipse-hawkbit/hawkbit/security/advisories/GHSA-92r3-p8c2-3fpx"
          },
          {
            "source": "emo@eclipse.org",
            "tags": [
              "Broken Link"
            ],
            "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/196"
          }
        ],
        "sourceIdentifier": "emo@eclipse.org",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-284"
              },
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "emo@eclipse.org",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-16454",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-22T18:58:35.078377Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-22T18:58:43.381Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "modules": [
                "eclipse-hawkbit/hawkbit"
              ],
              "product": "eclipse-hawkbit/hawkbit",
              "vendor": "Eclipse Foundation",
              "versions": [
                {
                  "lessThanOrEqual": "1.0.3",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                },
                {
                  "status": "unaffected",
                  "version": "1.0.4",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Santosh Kumar Puppala (GitHub: Santoshkumarpuppala, Email: santhoshkumar7794@gmail.com)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eIn\u0026nbsp;\u003cb\u003eEclipse hawkBit\u003c/b\u003e\u0026nbsp;versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller.\u003c/p\u003e\u003cp\u003eThis vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted\u0026nbsp;\u003cb\u003estrictly to the specific firmware artifacts explicitly\u003c/b\u003e\u0026nbsp;assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact\u0026nbsp;\u003cb\u003ewithin the same tenant\u003c/b\u003e.\u003c/p\u003e\u003cp\u003eThis is\u0026nbsp;\u003cb\u003enot\u003c/b\u003e\u0026nbsp;an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.\u003c/p\u003e\u003cp\u003eA related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass.\u003c/p\u003e"
                }
              ],
              "value": "In\u00a0Eclipse hawkBit\u00a0versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller.\n\n\n\nThis vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted\u00a0strictly to the specific firmware artifacts explicitly\u00a0assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact\u00a0within the same tenant.\n\n\n\nThis is\u00a0not\u00a0an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.\n\n\n\nA related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-284",
                  "description": "CWE-284",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-21T16:38:27.723Z",
            "orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
            "shortName": "eclipse"
          },
          "references": [
            {
              "url": "https://github.com/eclipse-hawkbit/hawkbit/security/advisories/GHSA-92r3-p8c2-3fpx"
            },
            {
              "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/196"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration",
          "x_generator": {
            "engine": "Vulnogram 1.0.4"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
        "assignerShortName": "eclipse",
        "cveId": "CVE-2026-16454",
        "datePublished": "2026-07-21T16:38:27.723Z",
        "dateReserved": "2026-07-21T10:01:44.585Z",
        "dateUpdated": "2026-07-22T18:58:48.011Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-16454

Vulnerability from fkie_nvd - Published: 2026-07-21 17:17 - Updated: 2026-10-24 19:10

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	emo@eclipse.org	https://github.com/eclipse-hawkbit/hawkbit/security/advisories/GHSA-92r3-p8c2-3fpx	Vendor Advisory
	emo@eclipse.org	https://gitlab.eclipse.org/security/cve-assignment/-/work_items/196	Broken Link

Impacted products

	Vendor	Product	Version
	eclipse	hawkbit	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "eclipse-hawkbit/hawkbit"
          ],
          "product": "eclipse-hawkbit/hawkbit",
          "vendor": "Eclipse Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "1.0.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "emo@eclipse.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eclipse:hawkbit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F95073D9-423D-4AF7-9DB9-6D0213E764B1",
              "versionEndExcluding": "1.0.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In\u00a0Eclipse hawkBit\u00a0versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller.\n\n\n\nThis vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted\u00a0strictly to the specific firmware artifacts explicitly\u00a0assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact\u00a0within the same tenant.\n\n\n\nThis is\u00a0not\u00a0an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.\n\n\n\nA related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass."
    },
    {
      "lang": "es",
      "value": "En las versiones 1.0.3 y anteriores de Eclipse hawkBit, se ha identificado una vulnerabilidad de escalada de privilegios (CWE-284 / CWE-862) en el controlador de Integraci\u00f3n Directa de Dispositivos (DDI).\n\nEsta vulnerabilidad permite a un dispositivo autenticado escalar sus permisos y omitir los l\u00edmites estrictos de sus actualizaciones asignadas. En funcionamiento normal, un dispositivo deber\u00eda estar restringido estrictamente a los artefactos de firmware espec\u00edficos que le han sido asignados expl\u00edcitamente. Sin embargo, este fallo permite a cualquier dispositivo autenticado omitir esta restricci\u00f3n y descargar cualquier artefacto de firmware dentro del mismo inquilino.\n\nEsto no es una omisi\u00f3n de autenticaci\u00f3n; el dispositivo solicitante debe poseer credenciales v\u00e1lidas para su inquilino respectivo. En cambio, el problema se deriva de un fallo en la validaci\u00f3n de autorizaci\u00f3n a nivel de objeto.\n\nExiste un problema auxiliar relacionado y de menor gravedad en el punto final de metadatos para listar artefactos de m\u00f3dulos de software. Este punto final no aplica comprobaciones de asignaci\u00f3n, lo que permite a un dispositivo autenticado listar y enumerar artefactos de firmware disponibles, lo que puede facilitar la exfiltraci\u00f3n dirigida utilizando la omisi\u00f3n de autorizaci\u00f3n de descarga principal."
    }
  ],
  "id": "CVE-2026-16454",
  "lastModified": "2026-10-24T19:10:00.127",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "emo@eclipse.org",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-16454",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-22T18:58:35.078377Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-21T17:17:05.887",
  "references": [
    {
      "source": "emo@eclipse.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/eclipse-hawkbit/hawkbit/security/advisories/GHSA-92r3-p8c2-3fpx"
    },
    {
      "source": "emo@eclipse.org",
      "tags": [
        "Broken Link"
      ],
      "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/196"
    }
  ],
  "sourceIdentifier": "emo@eclipse.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "emo@eclipse.org",
      "type": "Secondary"
    }
  ]
}

GHSA-92R3-P8C2-3FPX

Vulnerability from github – Published: 2026-11-06 18:09 – Updated: 2026-11-06 18:09

Summary

Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration

Details

Description

A privilege escalation vulnerability has been identified in the Direct Device Integration (DDI) Controller of Eclipse hawkBit (versions 1.0.3 and prior).

This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted strictly to the specific firmware artifacts explicitly assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact within the same tenant.

This is not an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.

A related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass.

Impact

Severity: Moderate
Scope: Tenant-isolated. An attacker must be an authenticated device within the target tenant to exploit this vulnerability.
Confidentiality Impact: Low. While firmware binaries can be retrieved, the impact is mitigated because access is restricted strictly to the scope of the pre-authenticated tenant, and no administrative or cross-tenant data is exposed. Additionally, production firmware binaries are by design not expected to contain highly sensitive or confidential data (such as hardcoded credentials or private keys), further supporting the Low confidentiality rating.

Affected Products and Versions

Product: eclipse-hawkbit/hawkbit
Affected Component: hawkbit-ddi/hawkbit-ddi-resource, as well as the compiled binaries and Docker images that contain this component.
Affected Versions: 1.0.3 and prior versions.
Patched Version: 1.0.4

Remediation

Upgrade to version 1.0.4 or later.

Fix details: The download authorization logic has been corrected to ensure that assignment-based verification is executed on every artifact download request. Additionally, the software module metadata endpoint has been updated to enforce proper authorization, restricting access exclusively to software modules and artifacts that are explicitly assigned to or already installed on the requesting device.

Credits

Eclipse would like to thank Santosh Kumar Puppala (GitHub: Santoshkumarpuppala, Email: santhoshkumar7794@gmail.com) for discovering and reporting this vulnerability through coordinated disclosure.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.hawkbit:hawkbit-ddi-resource"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-16454"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-06T18:09:45Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## **Description**\nA privilege escalation vulnerability has been identified in the Direct Device Integration (DDI) Controller of **Eclipse hawkBit** (versions 1.0.3 and prior).\n\nThis vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted **strictly to the specific firmware artifacts explicitly assigned to it**. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact **within the same tenant**.\n\nThis is **not** an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.\n\nA related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass.\n\n---\n\n## **Impact**\n* **Severity:** Moderate\n* **Scope:** Tenant-isolated. An attacker must be an authenticated device within the target tenant to exploit this vulnerability.\n* **Confidentiality Impact:** **Low**. While firmware binaries can be retrieved, the impact is mitigated because access is restricted strictly to the scope of the pre-authenticated tenant, and no administrative or cross-tenant data is exposed. Additionally, production firmware binaries are by design not expected to contain highly sensitive or confidential data (such as hardcoded credentials or private keys), further supporting the Low confidentiality rating.\n\n---\n\n## **Affected Products and Versions**\n* **Product:** `eclipse-hawkbit/hawkbit`\n* **Affected Component:** `hawkbit-ddi/hawkbit-ddi-resource`, as well as the compiled binaries and Docker images that contain this component.\n* **Affected Versions:** `1.0.3` and prior versions.\n* **Patched Version:** `1.0.4`\n\n---\n\n## **Remediation**\nUpgrade to version **1.0.4** or later. \n\n**Fix details:** The download authorization logic has been corrected to ensure that assignment-based verification is executed on every artifact download request. Additionally, the software module metadata endpoint has been updated to enforce proper authorization, restricting access exclusively to software modules and artifacts that are explicitly assigned to or already installed on the requesting device.\n\n---\n\n## **Credits**\nEclipse would like to thank **Santosh Kumar Puppala** (GitHub: [Santoshkumarpuppala](https://github.com/Santoshkumarpuppala), Email: santhoshkumar7794@gmail.com) for discovering and reporting this vulnerability through coordinated disclosure.",
  "id": "GHSA-92r3-p8c2-3fpx",
  "modified": "2026-11-06T18:09:45Z",
  "published": "2026-11-06T18:09:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/eclipse-hawkbit/hawkbit/security/advisories/GHSA-92r3-p8c2-3fpx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16454"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eclipse-hawkbit/hawkbit/pull/3156"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eclipse-hawkbit/hawkbit/pull/3161"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eclipse-hawkbit/hawkbit/commit/6cb34fd77f6a60cfb0ee5b379093593cbe56591a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eclipse-hawkbit/hawkbit/commit/914b8b406bd77838cffbef80c1ea4cff5a15c710"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/eclipse-hawkbit/hawkbit"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eclipse-hawkbit/hawkbit/releases/tag/1.0.4"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/196"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration"
}

GHSA-F3J8-8GGQ-F9X2

Vulnerability from github – Published: 2026-07-21 18:31 – Updated: 2026-11-06 18:06

Withdrawn 2026-11-06

Summary

Duplicate Advisory: Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-92r3-p8c2-3fpx. This link is maintained to preserve external references.

Original Description

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller.

This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted strictly to the specific firmware artifacts explicitly assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact within the same tenant.

This is not an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.hawkbit:hawkbit-ddi-resource"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-06T18:06:43Z",
    "nvd_published_at": "2026-07-21T17:17:05Z",
    "severity": "MODERATE"
  },
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-92r3-p8c2-3fpx. This link is maintained to preserve external references.\n\n### Original Description\nIn\u00a0Eclipse hawkBit\u00a0versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller.\n\n\n\nThis vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted\u00a0strictly to the specific firmware artifacts explicitly\u00a0assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact\u00a0within the same tenant.\n\n\n\nThis is\u00a0not\u00a0an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.\n\n\n\nA related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass.",
  "id": "GHSA-f3j8-8ggq-f9x2",
  "modified": "2026-11-06T18:06:43Z",
  "published": "2026-07-21T18:31:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/eclipse-hawkbit/hawkbit/security/advisories/GHSA-92r3-p8c2-3fpx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16454"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/196"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Duplicate Advisory: Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration",
  "withdrawn": "2026-11-06T18:06:43Z"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-16454 (GCVE-0-2026-16454)

FKIE_CVE-2026-16454

GHSA-92R3-P8C2-3FPX

Description

Impact

Affected Products and Versions

Remediation

Credits

GHSA-F3J8-8GGQ-F9X2

Duplicate Advisory

Original Description

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour