Sipeed PicoClaw CVE-2026-15320

Exploitation requires the attacker to hold low-privilege authenticated access to the Sipeed PicoClaw service (PR:L per CVSS 4.0 vector) - unauthenticated exploitation is not indicated by the available data. The attack targets the rt.ReloadConfig function specifically, meaning the PicoClaw service must be running and network-reachable. No special non-default configuration is stated as a prerequisite; the missing authorization check appears to exist in the default code path of the message.send argument handler. What limits exploitation is the requirement for at least low-level authenticated access, the constrained impact (integrity and availability at low severity only, no data exfiltration), and the absence of a scope change beyond the vulnerable system. The attack does not require user interaction and has low attack complexity once access is obtained.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) characterizes a network-reachable, low-complexity flaw requiring low privileges with no user interaction. Impact is constrained to limited integrity (VI:L) and limited availability (VA:L) within the vulnerable system only - no confidentiality exposure and no scope change to subsequent systems. This yields a moderate, not critical, real-world risk profile. A public proof-of-concept exists (E:P), elevating the realistic exploitation probability beyond a theoretical finding, but the product is niche with limited enterprise deployment. The absence of a KEV listing and the automatic closure of the GitHub issue due to vendor inactivity suggest no observed widespread exploitation. The low impact metrics mean even successful exploitation has bounded consequences. EPSS data was not provided in the input, so probability cannot be quantified numerically. The primary risk amplifier is the public exploit combined with the absence of any vendor-released fix.

A remote attacker with low-privilege access to the Sipeed PicoClaw service crafts a message containing a manipulated message.send argument targeting the rt.ReloadConfig function endpoint; because no authorization check is enforced, the server processes the request and reloads its configuration, potentially disrupting service availability or altering operational behavior. A public proof-of-concept is available at https://github.com/sipeed/picoclaw/issues/3071, lowering the skill threshold required to reproduce the attack.