Sipeed PicoClaw CVE-2026-16083

The target must be running Sipeed PicoClaw version 0.2.9 or earlier with the LINE Webhook integration explicitly configured and the webhook HTTP endpoint reachable from the attacker's network position. The attacker must first capture at least one valid LINE webhook request originating from LINE's servers - this requires either a network interception capability (man-in-the-middle, passive tap) or access to previously logged request payloads. No authentication to PicoClaw itself is required once a captured request is in hand. Exploitation is bounded to integrity impact on bot-triggered actions (VI:L); there is no path to data exfiltration or service disruption per the CVSS impact metrics. The attack is ineffective if LINE webhook integration is not configured, if the webhook endpoint is network-isolated from attacker reach, or if an upstream reverse proxy enforces source IP restriction to LINE's published IP ranges.

The CVSS 4.0 score of 6.9 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects network-accessible, low-complexity, unauthenticated exploitation with E:P confirming a public PoC. Impact is constrained to low integrity on the vulnerable system (VI:L), with no confidentiality or availability impact - meaning an attacker can inject bot actions but cannot exfiltrate data or crash the service. Real-world priority is moderated by PicoClaw's obscure footprint; this is not enterprise-grade infrastructure. However, the vendor's 'not planned' closure creates a permanent unpatched exposure for any deployed instance, and the public PoC lowers the exploitation barrier significantly. Active exploitation is not confirmed (not in CISA KEV), but the no-fix posture means risk will not naturally resolve over time.

An attacker positioned to observe network traffic to a PicoClaw instance (e.g., via passive monitoring on a shared network segment or a prior network-level compromise) captures a legitimate LINE webhook HTTP request containing a valid HMAC signature. The attacker then replays this request directly to the PicoClaw webhook endpoint; since ParseRequest performs no freshness or nonce check, the request is accepted as authentic and the associated bot action is triggered without the attacker ever possessing the LINE channel secret. A public PoC for this technique is available, lowering the skill threshold for exploitation.