CVE-2026-16454 with a CVSS score of 4.3 is a privilege escalation vulnerability in the Direct Device Integration Controller of Eclipse hawkBit, specifically affecting the org.eclipse.hawkbit:hawkbit-ddi-resource component. The flaw is an object-level authorization validation weakness in the DDI component that allows an authenticated device to bypass restrictions on firmware artifacts assigned to it. Under normal operation, a device should only retrieve firmware explicitly assigned to it, but the authorization check can be avoided so the device can download any firmware artifact within the same tenant. A related metadata listing endpoint also fails to enforce assignment checks, allowing an authenticated device to enumerate available firmware artifacts and facilitate targeted exfiltration. Exploitation over the network requires valid credentials for the target tenant and does not require administrative access or cross-tenant access. The business impact is moderate and tenant-isolated: an attacker can obtain firmware binaries from the tenant, but no administrative or cross-tenant data is exposed, and production firmware is not expected to contain highly sensitive material such as credentials or private keys.
We recommend you to update org.eclipse.hawkbit:hawkbit-ddi-resource to version 1.0.4 or later.[/subscribe_to_unlock_form]
CVE-2026-16454 with a CVSS score of 4.3 is a privilege escalation vulnerability in the Direct Device Integration Controller of Eclipse hawkBit, specifically affecting the org.eclipse.hawkbit:hawkbit-ddi-resource component. The flaw is an object-level authorization validation weakness in the DDI component that allows an authenticated device to bypass restrictions on firmware artifacts assigned to it. Under normal operation, a device should only retrieve firmware explicitly assigned to it, but the authorization check can be avoided so the device can download any firmware artifact within the same tenant. A related metadata listing endpoint also fails to enforce assignment checks, allowing an authenticated device to enumerate available firmware artifacts and facilitate targeted exfiltration. Exploitation over the network requires valid credentials for the target tenant and does not require administrative access or cross-tenant access. The business impact is moderate and tenant-isolated: an attacker can obtain firmware binaries from the tenant, but no administrative or cross-tenant data is exposed, and production firmware is not expected to contain highly sensitive material such as credentials or private keys.
We recommend you to update org.eclipse.hawkbit:hawkbit-ddi-resource to version 1.0.4 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]