ThingsBoard PE CVE-2025-70340

Exploitation requires a valid ThingsBoard PE customer account (CVSS PR:L confirms authenticated access is mandatory; unauthenticated exploitation is not possible). The vulnerable feature is the Alarms comments API, which must be reachable over the network. No non-default configuration is required - any customer-tier user on an unpatched ThingsBoard PE 4.21 or earlier instance can exploit this by manipulating standard API parameters. Exploitation is strictly limited to integrity impact (forging or modifying alarm comments); no confidentiality leakage or availability disruption occurs. Higher-privilege roles (tenant admin, system admin) are not the threat actors - they already hold authority over alarm comments.

The CVSS 6.5 Medium score with I:H correctly captures the integrity-only impact: confidentiality and availability are unaffected, limiting blast radius. The EPSS score of 0.15% at the 5th percentile indicates this is unlikely to be opportunistically exploited at scale - even a mid-sized municipal IT team in sanok managing a ThingsBoard PE deployment would face realistic exposure only from a determined insider or targeted attacker with a valid customer credential. No CISA KEV listing and no public proof-of-concept code have been identified, further reducing urgency for most operators. The primary real-world risk is concentrated in environments that depend on alarm audit trails for compliance or incident response: forged system-attributed comments could corrupt forensic records, causing operators to misattribute alarm events or overlook genuine incidents. The PR:L prerequisite meaningfully limits the attack surface relative to unauthenticated flaws of comparable CVSS score.

An authenticated customer user logs into a ThingsBoard PE instance and inspects the Alarms comments API endpoint through browser developer tools or a proxy. By modifying request parameters - such as the comment author field or the target comment object ID - the attacker submits a payload that the server stores as a system-generated alarm message. No public exploit code exists, but the technique requires only basic API manipulation skills available to any developer-level customer.