CVE-2026-16454

{
  "id": "CVE-2026-16454",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T17:17:05.887",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller.\n\n\n\nThis vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted strictly to the specific firmware artifacts explicitly assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact within the same tenant.\n\n\n\nThis is not an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.\n\n\n\nA related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass."
    },
    {
      "lang": "es",
      "value": "En las versiones 1.0.3 y anteriores de Eclipse hawkBit, se ha identificado una vulnerabilidad de escalada de privilegios (CWE-284 / CWE-862) en el controlador de Integración Directa de Dispositivos (DDI).\n\nEsta vulnerabilidad permite a un dispositivo autenticado escalar sus permisos y omitir los límites estrictos de sus actualizaciones asignadas. En funcionamiento normal, un dispositivo debería estar restringido estrictamente a los artefactos de firmware específicos que le han sido asignados explícitamente. Sin embargo, este fallo permite a cualquier dispositivo autenticado omitir esta restricción y descargar cualquier artefacto de firmware dentro del mismo inquilino.\n\nEsto no es una omisión de autenticación; el dispositivo solicitante debe poseer credenciales válidas para su inquilino respectivo. En cambio, el problema se deriva de un fallo en la validación de autorización a nivel de objeto.\n\nExiste un problema auxiliar relacionado y de menor gravedad en el punto final de metadatos para listar artefactos de módulos de software. Este punto final no aplica comprobaciones de asignación, lo que permite a un dispositivo autenticado listar y enumerar artefactos de firmware disponibles, lo que puede facilitar la exfiltración dirigida utilizando la omisión de autorización de descarga principal."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Eclipse Foundation",
          "product": "eclipse-hawkbit/hawkbit",
          "defaultStatus": "unaffected",
          "modules": [
            "eclipse-hawkbit/hawkbit"
          ],
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.0.3",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "1.0.4",
              "versionType": "custom",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T18:58:35.078377Z",
          "id": "CVE-2026-16454",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:eclipse:hawkbit:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.0.4",
              "matchCriteriaId": "F95073D9-423D-4AF7-9DB9-6D0213E764B1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/eclipse-hawkbit/hawkbit/security/advisories/GHSA-92r3-p8c2-3fpx",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/196",
      "source": "[email protected]",
      "tags": [
        "Broken Link"
      ]
    }
  ]
}