Eclipse Kura CVE-2026-113422

Requires an authenticated Kura identity that holds the Wires management permission - kura.wires.admin for the Web UI or rest.wires.admin for the Wire Service REST API v1 - and at least one Driver must be installed on the device for arbitrary (non-Wire-Graph) components to be modifiable. The exploitable surface is the Wire Graph update functionality of the Kura Web UI and the REST API v1 (org.eclipse.kura.rest.wire.provider, present since 5.1.0). Limiting factors: this is not unauthenticated access (an attacker must already possess a valid low-privilege account with the specific Wires permission), the installed-Driver requirement (reflected as AT:P in the 4.0 vector) must be met for the full arbitrary-component modification, and only versions 5.0.0 through 5.6.2 are affected - 5.6.3 fixes it.

This is a credible, prioritize-this-week issue rather than a theoretical high-CVSS item, but it is gated by authentication and is not a mass-exploitation candidate. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) scores 7.7 and is internally consistent with the description: AV:N reflects the network-reachable Web UI and REST API v1, PR:L reflects that the attacker needs an authenticated identity holding only the low-privilege Wires management permission (kura.wires.admin or rest.wires.admin), and AT:P maps directly to the stated precondition that at least one Driver must be installed for arbitrary components to be modifiable. Impact is high across confidentiality, integrity and availability (VC:H/VI:H/VA:H) because the flaw - CWE-807, reliance on the attacker-supplied factory identifier in a security decision - lets a limited operator escalate to full administrative privileges and disrupt the device. The vuln.today Decision label is this_week, consistent with a serious but authenticated, non-wormable privilege-escalation bug. No EPSS score, no CISA KEV listing, and no SSVC decision data were supplied, and no exploitation activity is indicated; exploitation status is therefore no public exploit identified at time of analysis. The only references provided are the Eclipse GHSA advisory and the Eclipse GitLab CVE-assignment work item, which document the flaw but are not exploit code. Net: real priority for Kura operators because it converts a scoped permission into full admin, but the PR:L and the installed-Driver requirement meaningfully narrow the realistic attacker set compared to an unauthenticated RCE.

An attacker who already holds a low-privilege Kura account limited to the Wires management permission sends a Wire Graph update (via the Web UI) or a Wire Service REST API v1 request in which the supplied factory identifier does not match the real factory of an existing component. Because the code trusts the supplied identifier instead of the component's actual factory, the attacker modifies or replaces a security-relevant component outside the Wire Graph and escalates to full administrative control of the device, or disrupts it. No public exploit code is identified; exploitation requires a valid authenticated identity and at least one Driver installed on the device.