EUVD-2025-210791
GHSA-433r-pgvp-mq8p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible API requiring only a customer credential (PR:L), low complexity manipulation; impact is integrity-only via forged system alarm comments.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows unauthorized impersonation of system messages and modification of trusted system-owned data, resulting in vertical privilege escalation and potential integrity violations.
AnalysisAI
Broken access control in ThingsBoard Professional Edition 4.21 and below allows authenticated customer-tier users to manipulate API parameters in the Alarms comments endpoint to forge or overwrite system-generated alarm comments. Because customer accounts are low-privileged by design, the ability to impersonate system messages and overwrite system-owned data constitutes vertical privilege escalation with direct integrity impact on alarm audit trails. No public exploit code exists and the EPSS score of 0.15% (5th percentile) indicates low exploitation probability, but the flaw is easily reproducible by any valid customer credential on an unpatched instance.
Technical ContextAI
ThingsBoard is an IoT device management and data visualization platform; the Professional Edition adds multi-tenancy, role-based access control tiers, and advanced alarm management. The Alarms comments functionality allows both users and the system itself to annotate alarm events with structured messages. CWE-284 (Improper Access Control) identifies the root cause as a failure to enforce object-level authorization checks on the comments API: a customer user can supply arbitrary parameters - such as a forged author identity or a system-owned comment object identifier - that the server accepts without validating whether the caller holds rights over those objects. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms the flaw is network-exploitable by any authenticated low-privilege user with no special configuration required. The CPE provided in NVD (cpe:2.3:a:n/a:n/a) is a known placeholder and does not accurately identify the product.
RemediationAI
Upgrade ThingsBoard PE to a version beyond 4.21 once the vendor releases a confirmed patched build; consult the 4.2.x release notes at https://thingsboard.io/docs/releases/releases-table/v4-2-x/ for the specific fix version - no exact patched release number has been independently confirmed from the available data. As a compensating control, restrict customer account provisioning to vetted, trusted users and audit alarm comment logs regularly for system-attributed entries authored by customer-tier accounts, which would be anomalous. If the deployment sits behind an API gateway, consider alerting on unexpected modifications to alarm comment objects owned by the system. No separate vendor security advisory beyond the release notes has been identified.
Same weakness CWE-284 – Improper Access Control
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today