Eclipse Hawkbit Hawkbit
Monthly
Privilege escalation in Eclipse hawkBit's Direct Device Integration (DDI) Controller allows any authenticated device to download firmware artifacts beyond those explicitly assigned to it, within the same tenant. The flaw - rooted in missing object-level authorization (CWE-284/CWE-862) - means a valid device credential is sufficient to access arbitrary firmware artifacts belonging to other devices in the same tenant, not just the device's own assigned updates. A secondary enumeration weakness in the software modules listing endpoint compounds the issue by enabling targeted discovery of available artifacts. No public exploit has been identified at time of analysis, and no CISA KEV listing is present.
Privilege escalation in Eclipse hawkBit's Direct Device Integration (DDI) Controller allows any authenticated device to download firmware artifacts beyond those explicitly assigned to it, within the same tenant. The flaw - rooted in missing object-level authorization (CWE-284/CWE-862) - means a valid device credential is sufficient to access arbitrary firmware artifacts belonging to other devices in the same tenant, not just the device's own assigned updates. A secondary enumeration weakness in the software modules listing endpoint compounds the issue by enabling targeted discovery of available artifacts. No public exploit has been identified at time of analysis, and no CISA KEV listing is present.