CVE-2026-16454

{"id": "CVE-2026-16454", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16454", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T18:58:35.078377Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"vendor": "Eclipse Foundation", "modules": ["eclipse-hawkbit/hawkbit"], "product": "eclipse-hawkbit/hawkbit", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0.3"}, {"status": "unaffected", "version": "1.0.4", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-21T17:17:05.887", "references": [{"url": "https://github.com/eclipse-hawkbit/hawkbit/security/advisories/GHSA-92r3-p8c2-3fpx", "tags": ["Vendor Advisory"], "source": "emo@eclipse.org"}, {"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/196", "tags": ["Broken Link"], "source": "emo@eclipse.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "In\u00a0Eclipse hawkBit\u00a0versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller.\n\n\n\nThis vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted\u00a0strictly to the specific firmware artifacts explicitly\u00a0assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact\u00a0within the same tenant.\n\n\n\nThis is\u00a0not\u00a0an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.\n\n\n\nA related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass."}, {"lang": "es", "value": "En las versiones 1.0.3 y anteriores de Eclipse hawkBit, se ha identificado una vulnerabilidad de escalada de privilegios (CWE-284 / CWE-862) en el controlador de Integraci\u00f3n Directa de Dispositivos (DDI).\n\nEsta vulnerabilidad permite a un dispositivo autenticado escalar sus permisos y omitir los l\u00edmites estrictos de sus actualizaciones asignadas. En funcionamiento normal, un dispositivo deber\u00eda estar restringido estrictamente a los artefactos de firmware espec\u00edficos que le han sido asignados expl\u00edcitamente. Sin embargo, este fallo permite a cualquier dispositivo autenticado omitir esta restricci\u00f3n y descargar cualquier artefacto de firmware dentro del mismo inquilino.\n\nEsto no es una omisi\u00f3n de autenticaci\u00f3n; el dispositivo solicitante debe poseer credenciales v\u00e1lidas para su inquilino respectivo. En cambio, el problema se deriva de un fallo en la validaci\u00f3n de autorizaci\u00f3n a nivel de objeto.\n\nExiste un problema auxiliar relacionado y de menor gravedad en el punto final de metadatos para listar artefactos de m\u00f3dulos de software. Este punto final no aplica comprobaciones de asignaci\u00f3n, lo que permite a un dispositivo autenticado listar y enumerar artefactos de firmware disponibles, lo que puede facilitar la exfiltraci\u00f3n dirigida utilizando la omisi\u00f3n de autorizaci\u00f3n de descarga principal."}], "lastModified": "2026-10-24T19:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:hawkbit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F95073D9-423D-4AF7-9DB9-6D0213E764B1", "versionEndExcluding": "1.0.4"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}