EUVD-2026-45407
GHSA-vf62-q3j8-cj9g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to PicoClaw with low-privilege credentials
-
DeliverySubmit crafted web_fetch request with 198.18.x.x target URL
-
ExploitisPrivateOrRestrictedIP fails to block RFC 2544 benchmark range
-
ExecutionServer issues outbound HTTP request to target IP
-
ImpactResponse returned to attacker, exposing internal service data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have low-privilege authenticated access to the PicoClaw instance (PR:L per CVSS 4.0 vector) - unauthenticated exploitation is not supported by the available data. The |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/E:P) scores 2.1, placing this firmly in the low-severity range. The PR:L metric confirms that exploitation requires at minimum low-privilege authenticated access, limiting opportunistic mass exploitation. The E:P modifier aligns with the confirmed public PoC on GitHub. No CISA KEV listing is present, and no EPSS score was provided in the input data - EPSS cannot be assessed. The practical blast radius is further constrained by the target range: 198.18.0.0/15 is designated for RFC 2544 benchmarking and is not routinely routed or used for internal services in most deployments, making successful SSRF to a meaningful internal target via this bypass unlikely in typical environments. This is a real but low-priority vulnerability - meaningful primarily if an attacker is specifically aware of services listening on benchmark-range IPs in the target environment. |
| Exploit ScenarioDerived | An authenticated low-privileged user submits a crafted URL targeting an IP in the 198.18.0.0/15 range (e.g., |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 18, 2026
Server-side request forgery in Sipeed PicoClaw through version 0.2.9 allows low-privileged remote attackers to cause the server to issue outbound HTTP requests to the RFC 2544 benchmark address range (198.18.0.0/15), which was omitted from the private/restricted IP blocklist in the isPrivateOrRestrictedIP function. The CVSS 4.0 score of 2.1 reflects the narrow impact scope and authentication requirement (PR:L). A publicly available proof-of-concept exists via GitHub issue #3077, and an upstream patch has been committed but no tagged release version has been independently confirmed as shipping the fix.
RemediationAI
Apply the upstream patch from commit 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405 available via GitHub pull request #3085 (https://github.com/sipeed/picoclaw/pull/3085); this adds the 198.18.0.0/15 RFC 2544 benchmark range to the isPrivateOrRestrictedIP blocklist. Note that no specifically tagged release version containing this fix has been independently confirmed - operators should build from the patched commit. As a compensating network-level control, block outbound egress from the PicoClaw host to 198.18.0.0/15 at the firewall or network layer; this does not fix the code-level gap but prevents exploitation of this specific bypass without rebuilding the application. Restricting which users can invoke the web_fetch integration (reducing the authenticated user pool) also limits exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PicoClaw is a Go-language application by Sipeed. Its web_fetch integration component (file pkg/tools/integration/web.go) includes a function isPrivateOrRestrictedIP that validates destination IP addresses before issuing outbound HTTP requests, implementing a server-side SSRF protection layer. The root cause (CWE-918: Server-Side Request Forgery) is an incomplete blocklist: the function correctly blocked RFC 1918 private ranges (10.x, 172.16-31.x, 192.168.x) and CGNAT (100.64.0.0/10) but omitted the RFC 2544 network testing benchmark range 198.18.0.0/15. The patch (commit 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405, PR #3085) adds the condition (ip4[0] == 198 && ip4[1] >= 18 && ip4[1] <= 19) to close the gap. The affected CPE is cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:* covering all versions up to and including 0.2.9.
Know when Picoclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network SSRF requiring low-privilege auth; no meaningful availability impact from requests to unpopulated RFC 2544 benchmark addresses.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Impacted is the function isPrivateOrRestrictedIP of the file pkg/tools/integration/web.go of the component web_fetch. This manipulation causes server-side request forgery. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405. To fix this issue, it is recommended to deploy a patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Authentication bypass via capture-replay in Sipeed PicoClaw's LINE Webhook handler permits remote unauthenticated attack
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows unauthenticated remote attackers to make the s
Improper access control in Sipeed PicoClaw up to version 0.2.9 allows remote unauthenticated attackers to bypass the IP
Missing authorization in PicoClaw's Feishu group message handler allows authenticated remote attackers to perform unauth
Incorrect authorization in Sipeed PicoClaw's WeCom Group Message Handler allows authenticated remote attackers to bypass
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows remote attackers to manipulate the WebFetchToo
Missing authorization in Sipeed PicoClaw up to version 0.2.9 permits remote low-privileged attackers to invoke the rt.Re
Incorrect authorization in Sipeed PicoClaw's MQTT Channel Handler (pkg/channels/mqtt/mqtt.go) through version 0.2.9 allo
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin
Inclusion of functionality from an untrusted control sphere (CWE-829) in Sipeed PicoClaw through version 0.2.9 allows a
Time-of-check time-of-use race condition in Sipeed PicoClaw up to version 0.2.9 allows locally authenticated low-privile
Remote command injection in PicoClaw Web Launcher Management Plane (versions up to 0.2.4) allows unauthenticated attacke
Exploit-DB