Sipeed PicoClaw CVE-2026-15317

Exploitation requires that PicoClaw is deployed and its WebFetchTool.Execute function within the Guarded Web Fetch Flow is reachable over the network. The CVSS 4.0 vector specifies UI:P (passive user interaction), meaning an end-user action - such as submitting a URL or triggering a web fetch through the application UI - must occur for the SSRF payload to be processed; fully autonomous, zero-user-interaction exploitation is not reflected in the scoring. No authentication is required (PR:N) and attack complexity is low (AC:L). Exploitation is practically limited by: (1) the need for passive user interaction to initiate the fetch; (2) the server's actual network reachability to internal targets for SSRF to yield meaningful results - if the host is isolated or has strict egress controls, impact is negligible; and (3) the low CVSS impact ceiling (VC:L/VI:L/VA:L), indicating only partial information disclosure or limited modification per exploitation. No special configuration setting is described as required beyond the application being deployed and accessible.

Real-world risk is substantially limited by multiple converging signals. The CVSS 4.0 base score of 2.1 is very low, with impact metrics uniformly scored low (VC:L/VI:L/VA:L) and no subsequent-system impact (SC:N/SI:N/SA:N), indicating limited data exfiltration potential under the vulnerability's own mechanics. The requirement for passive user interaction (UI:P) prevents fully autonomous exploitation, narrowing the attacker's window. No CISA KEV listing exists, meaning active widespread exploitation has not been confirmed by any authoritative source - the E:P threat metric confirms only that exploit code has been publicly released, not that it is being actively weaponized. The low prevalence of PicoClaw in production enterprise environments further dampens aggregate risk. However, the absence of a vendor patch and automatic closure of the GitHub issue due to inactivity - rather than a code fix - means no remediation path currently exists through normal channels, which is a structural concern. In environments where the PicoClaw host has network access to sensitive internal services or cloud metadata, the practical SSRF impact could exceed what the CVSS scores suggest. EPSS data was not provided in the input; exploitation probability cannot be quantified from available data.

A remote attacker submits a crafted URL - targeting an internal service such as the AWS instance metadata endpoint at http://169.254.169.254/latest/meta-data/ - to the PicoClaw WebFetchTool.Execute interface after eliciting or waiting for a passive user interaction that triggers the fetch. The Guarded Web Fetch Flow fails to block the malicious URL, and the PicoClaw server fetches the internal resource and returns the response to the attacker. A public exploit is available (referenced in VulDB CTI at https://vuldb.com/vuln/377257/cti), lowering the technical barrier, though practical yield depends on what internal services are reachable from the server.