Eclipse BaSyx Java Server SDK EUVD-2026-27384

Exploitation requires the Eclipse BaSyx Java Server SDK Submodel HTTP API with file upload functionality to be enabled and network-accessible to the attacker. Specifically, the vulnerable fileName parameter handling in file upload operations must be reachable via HTTP/HTTPS requests. No authentication is required (PR:N in CVSS vector), making any exposed instance immediately vulnerable. No user interaction is needed (UI:N), and attack complexity is low (AC:L), meaning exploitation succeeds reliably against default vulnerable configurations. Organizations that have disabled the Submodel HTTP API entirely, blocked network access to file upload endpoints via firewall rules, or do not use the file upload feature are not exploitable through this specific vulnerability. The severity is highest for internet-facing deployments and industrial automation environments where BaSyx manages critical Asset Administration Shell data.

This represents a critical real-world risk combining maximum CVSS severity with practical exploitation conditions. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) confirms worst-case attack characteristics: network-accessible, low complexity, no authentication required, no user interaction needed, and changed scope indicating cascading impact beyond the vulnerable component. The path traversal to RCE chain is well-understood and reliably exploitable when path normalization is absent. EPSS and KEV data are not available for this recently-assigned CVE, limiting predictive exploitation probability assessment. However, the combination of unauthenticated network exposure, maximum CVSS score, and clear RCE impact in an industrial automation framework suggests immediate priority for organizations running Eclipse BaSyx in production environments. The vulnerability's exploitability depends entirely on whether the Submodel HTTP API file upload functionality is exposed to network access - organizations that have not enabled or exposed this specific API endpoint face reduced risk. Real-world impact severity depends on Java process privileges and deployment architecture; containerized or least-privilege deployments limit post-exploitation lateral movement compared to monolithic deployments running as root or highly-privileged service accounts.

An unauthenticated remote attacker identifies an internet-exposed Eclipse BaSyx Java Server SDK instance running the vulnerable Submodel HTTP API. The attacker crafts an HTTP POST request to the file upload endpoint with a malicious fileName parameter containing directory traversal sequences such as '../../../webapps/malicious.jsp' or '../../../config/application.properties'. The inadequate path normalization allows this crafted path to bypass intended storage boundaries, writing the attacker's payload to an arbitrary filesystem location. By uploading a malicious JSP web shell to the web application directory or overwriting configuration files with malicious startup scripts, the attacker achieves remote code execution with the privileges of the Java process, leading to complete system compromise, data exfiltration, and potential pivot points for lateral movement within industrial control networks.