CVE-2025-70340

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows unauthorized impersonation of system messages and modification of trusted system-owned data, resulting in vertical privilege escalation and potential integrity violations.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/thingsboard/thingsboard
https://thingsboard.io/docs/releases/releases-table/v4-2-x/

Configurations

No configuration.

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de control de acceso roto en ThingsBoard Professional Edition (PE) hasta la versión 4.21 incluida, dentro de la funcionalidad de comentarios de alarmas. Un usuario cliente autenticado puede manipular los parámetros de la solicitud API correspondientes para crear o modificar comentarios de alarmas generados por el sistema. Esto permite la suplantación no autorizada de mensajes del sistema y la modificación de datos confiables propiedad del sistema, resultando en una escalada de privilegios vertical y posibles violaciones de integridad.

Information

Published : 2026-08-26 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2025-70340

Mitre link : CVE-2025-70340

CVE.ORG link : CVE-2025-70340

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

{"id": "CVE-2025-70340", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-70340", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-01T18:40:29.848653Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-08-26T20:16:59.823", "references": [{"url": "https://github.com/thingsboard/thingsboard", "source": "cve@mitre.org"}, {"url": "https://thingsboard.io/docs/releases/releases-table/v4-2-x/", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows unauthorized impersonation of system messages and modification of trusted system-owned data, resulting in vertical privilege escalation and potential integrity violations."}, {"lang": "es", "value": "Existe una vulnerabilidad de control de acceso roto en ThingsBoard Professional Edition (PE) hasta la versi\u00f3n 4.21 incluida, dentro de la funcionalidad de comentarios de alarmas. Un usuario cliente autenticado puede manipular los par\u00e1metros de la solicitud API correspondientes para crear o modificar comentarios de alarmas generados por el sistema. Esto permite la suplantaci\u00f3n no autorizada de mensajes del sistema y la modificaci\u00f3n de datos confiables propiedad del sistema, resultando en una escalada de privilegios vertical y posibles violaciones de integridad."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "cve@mitre.org"}