Sipeed PicoClaw CVE-2026-15318

Exploitation requires the attacker to have network connectivity to the Sipeed PicoClaw MQTT broker and the ability to initiate a low-privilege MQTT connection (consistent with PR:L in the CVSS 4.0 vector). The specific triggering condition is manipulation of the client_id argument during MQTT channel handler operations in pkg/channels/mqtt/mqtt.go - the handler does not correctly enforce that the client_id presented corresponds to the authenticated session's authorized identity. No user interaction is required and no special attack prerequisites (AT:N) apply beyond connectivity. Exploitation is limited by: (1) the requirement for at least low-privilege MQTT broker access, meaning deployments with strong broker authentication and no anonymous connections reduce exposure; (2) the attack does not cross system boundaries (SC:N/SI:N/SA:N), confining impact to the PicoClaw instance; and (3) the non-default or niche nature of the product itself limits the target population. Fully unauthenticated exploitation against brokers requiring credentials is not confirmed from available data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) places this as a network-exploitable, low-complexity vulnerability requiring only low-privilege access, with a proof-of-concept exploitability modifier, yielding a score of 5.3 (medium). The PR:L requirement is a meaningful constraint - the attacker must be able to establish an MQTT connection, which in properly configured deployments requires some form of broker-level authentication. The low C/I/A impact metrics and absence of scope change (SC/SI/SA all N) confirm the blast radius is confined to the PicoClaw instance itself. No CISA KEV listing exists, and EPSS data was not provided in the input - exploitation frequency in the wild is therefore unknown. The publicly available POC (GitHub issue #3068) and absence of any vendor patch are the primary risk amplifiers. The niche deployment footprint of Sipeed PicoClaw substantially limits the total population of vulnerable targets. Overall, this is a real but bounded vulnerability: prioritize remediation in multi-tenant or externally reachable MQTT deployments, but it is not a broad critical priority.

An attacker with low-privilege access to the MQTT broker - such as a legitimately registered IoT device or any client on the same network segment - uses the publicly available proof-of-concept to send an MQTT connection or channel-access request with a spoofed client_id belonging to a different, higher-privilege client. The PicoClaw MQTT Channel Handler's flawed authorization logic accepts the manipulated identifier without verifying it against the authenticated session, granting the attacker read and write access to the victim client's MQTT channels and enabling message interception or injection within the IoT messaging fabric.