What is the CVSS score of CVE-2026-16454?

CVE-2026-16454 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Eclipse hawkBit CVE-2026-16454

EUVD-2026-46316 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 eclipse

GHSA-f3j8-8ggq-f9x2

Authentication Bypass Privilege Escalation Eclipse Hawkbit Hawkbit Eclipse Foundation

4.3

CVSS 3.1 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

DDI API is network-accessible; valid device credentials required (PR:L); impact limited to reading unassigned firmware artifacts within the same tenant (C:L), with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 17:31 vuln.today

DescriptionCVE.org

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller.

This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted strictly to the specific firmware artifacts explicitly assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact within the same tenant.

This is not an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.

A related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass.

AnalysisAI

Privilege escalation in Eclipse hawkBit's Direct Device Integration (DDI) Controller allows any authenticated device to download firmware artifacts beyond those explicitly assigned to it, within the same tenant. The flaw - rooted in missing object-level authorization (CWE-284/CWE-862) - means a valid device credential is sufficient to access arbitrary firmware artifacts belonging to other devices in the same tenant, not just the device's own assigned updates. A secondary enumeration weakness in the software modules listing endpoint compounds the issue by enabling targeted discovery of available artifacts. No public exploit has been identified at time of analysis, and no CISA KEV listing is present.

Technical ContextAI

Eclipse hawkBit is an open-source IoT firmware/software update management platform developed under the Eclipse Foundation. The Direct Device Integration (DDI) API is the standard protocol interface through which managed IoT devices poll for assigned updates and download firmware artifacts. The root causes are CWE-284 (Improper Access Control) and CWE-862 (Missing Authorization): the DDI Controller validates that the requesting device holds a valid tenant credential but fails to enforce object-level authorization - specifically, it does not verify that the requested firmware artifact is actually assigned to the requesting device. A companion weakness exists in the artifact metadata listing endpoint, which omits assignment-scoped filtering entirely, allowing any authenticated device to enumerate all firmware artifacts available within the tenant. The affected CPE is cpe:2.3:a:eclipse_foundation:eclipse-hawkbit/hawkbit:*:*:*:*:*:*:*:* covering versions 1.0.3 and prior.

RemediationAI

Apply the vendor-released patch per the Eclipse hawkBit security advisory at https://github.com/eclipse-hawkbit/hawkbit/security/advisories/GHSA-92r3-p8c2-3fpx - an exact fixed version number is not independently confirmed in available intelligence and must be verified directly from the advisory before deployment. As a compensating control until patching is complete, segment devices into dedicated single-device or single-role tenants so that a compromised device's tenant contains only its own assigned artifacts, eliminating lateral access to other devices' firmware. Restrict DDI API endpoint access using network-level controls (firewall rules, API gateway policies) to only the expected device source IPs or subnets, reducing the attacker's ability to reach the endpoint from rogue or compromised devices. Audit DDI artifact download logs for anomalous access patterns where a device ID is requesting artifact IDs not in its assignment list. Note that tenant segmentation increases operational overhead in large fleets and may require hawkBit configuration changes.