The flaw exists in Sipeed PicoClaw's rt.ReloadConfig function, where an attacker can manipulate the message.send argument to bypass authorization checks. This allows the attacker to trigger a configuration reload without proper privileges. Based on the description, it is inferred that the attacker could modify device settings or disrupt services. The impact is that the device's configuration integrity compromised, potentially leading to further exploitation if other vulnerabilities are present.

Sipeed PicoClaw devices running firmware version 0.2.9 or earlier are affected. The vulnerability applies to the pico.go component in the pico module of the firmware.

The issue carries a CVSS score of 5.3, indicating moderate risk. The EPSS score is < 1% and the vulnerability is not listed in CISA's KEV catalog. The attack can be performed remotely, and a public exploit is known, meaning that exposed devices are at risk. The missing authorization aligns with CWE-862 and additional privilege escalation concerns in CWE-863.