OpenRemote’s KNXProtocol.startAssetImport method processes uploaded ETS project ZIP files using XML parsers that permit external entity resolution. An authenticated user can supply a crafted XML payload that references any local file or URL. Because the XMLInputFactory does not disable external entities, the application retrieves the referenced content, enabling the attacker to read arbitrary files on the server or initiate outbound HTTP requests. This can expose sensitive configuration files, credentials, or other secrets, and may lead to further exploitation of the host environment. The vulnerability is an incomplete remediation of a prior issue but remains unprotected in the KNX handler while the Velbus handler was hardened.

The vulnerability affects OpenRemote deployments using the openremote-manager and openremote packages, specifically any version prior to 1.24.2. Versions 1.24.2 and newer contain the fix. All instances that allow authenticated users to import ETS project ZIP files via KNXProtocol.startAssetImport are impacted.

The CVSS score of 7.6 indicates a high severity, and while no EPSS data is currently available, the exploit requires authenticated access, which is common in many IoT environments. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known public exploit yet, but the attack path—an authenticated user uploading crafted content—can be executed from the client side. The resulting arbitrary file read may compromise confidentiality and provide a foothold for further attacks on the host system if the server is inadequately protected.