CVE-2026-15318

Sipeed PicoClaw MQTT Channel mqtt.go authorization

View on CVE.org
Published Jul 10, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument client_id causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

Analysis

AI-generated

Technical impact

Sipeed PicoClaw devices up to version 0.2.9 contain a flaw in the MQTT Channel Handler where manipulation of the client_id argument can lead to incorrect authorization decisions. This weakness allows an attacker to impersonate a legitimate client or gain unauthorized access to MQTT topics. The flaw is linked to CWE-285 (Authorization) and CWE-863 (Role‑Based Access Control).

Affected Systems

The affected product is Sipeed PicoClaw, specifically versions up to 0.2.9. No fixed release is listed in the current data, so any deployment running a version prior to 0.2.9 is vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The description notes that the attack can be carried out remotely by sending a crafted client_id to the MQTT channel. No additional exploitation conditions are stated, so network exposure of the MQTT service increases risk.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a PicoClaw version newer than 0.2.9 once a vendor patch is released
  • Configure the MQTT broker to enforce authentication and restrict client ID patterns, ensuring only authorized clients can connect
  • Implement broker‑side access control lists to limit which topics authenticated clients may publish or subscribe to
  • If a patch is unavailable, consider isolating the MQTT service within a trusted network segment or disabling the vulnerable channel until remediation is applied

Generated by OpenCVE AI on August 1, 2026 at 13:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument client_id causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed automatically due to inactivity.
Title Sipeed PicoClaw MQTT Channel mqtt.go authorization
First Time appeared Sipeed
Sipeed picoclaw
Weaknesses CWE-285
CWE-863
CPEs cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*
Vendors & Products Sipeed
Sipeed picoclaw
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 10, 2026, 8:31 PM
Reserved
Jul 9, 2026, 6:07 PM

View source JSON

Updated
Jul 10, 2026, 8:26 PM

JSON

Status
Deferred
Published
Jul 10, 2026, 2:16 AM
Modified
Oct 25, 2026, 3:10 PM

View source JSON

No data.

Updated
Aug 1, 2026, 1:30 PM

JSON