Sipeed PicoClaw CVE-2026-15319

The PicoClaw web backend Launcher interface must be network-accessible (i.e., listening on a network interface reachable by the attacker). The IPAllowlist feature must be in use as the primary access control mechanism - environments that do not rely on application-layer IP filtering, or that enforce allowlisting at the firewall/load-balancer level, have a reduced but not eliminated attack surface. No authentication credentials, user interaction, or special privileges are required (PR:N, UI:N per CVSS 4.0). Exploitation is limited to versions up to 0.2.9; deployments behind a properly enforced network-level IP allowlist independent of the application are protected from remote exploitation. No platform-specific OS dependency has been identified.

The CVSS 4.0 base score of 6.9 with VC:L/VI:L/VA:L reflects limited but real impact: an attacker gains unauthorized access to web-accessible endpoints that would otherwise be restricted by the IP allowlist. The PR:N and AC:L metrics indicate straightforward unauthenticated remote exploitation with low complexity, which combined with the confirmed public exploit (E:P supplemental metric) meaningfully elevates practical risk above what the moderate base score alone suggests. CISA KEV status is not confirmed, meaning active mass exploitation has not been formally observed, but the availability of a public POC lowers the barrier for opportunistic attackers. The product's niche deployment footprint limits aggregate exposure, but any organization running PicoClaw's web interface on a network-accessible interface should treat this as a genuine priority rather than a theoretical risk, particularly since the middleware is explicitly designed as an access gate.

A remote unauthenticated attacker sends crafted HTTP requests to the PicoClaw Launcher web interface from an IP address that should be blocked by the configured allowlist. By exploiting the logic flaw in the IPAllowlist middleware function - potentially through header injection or IP representation manipulation - the attacker bypasses the access restriction and reaches protected backend endpoints, gaining unauthorized read and write access to Launcher functionality. A public proof-of-concept demonstrating this bypass is available at the GitHub issue tracker.