CVE-2026-113422

Name of the Vulnerable Software and Affected Versions Eclipse Kura versions 5.0.0 through 5.6.2

Description The Wire Graph update functionality in the Kura Web UI and the Wire Service REST API v1 (org.eclipse.kura.rest.wire.provider) incorrectly determine if a configuration update targets a Wire Component, Driver, or Asset by using the factory identifier provided in the request rather than the actual factory of the existing component. An authenticated user with only Wires management permissions (kura.wires.admin for the Web UI and rest.wires.admin for the REST API) can modify the configuration of components outside the Wire Graph, including security-sensitive ones, or replace existing components. This can lead to full administrative privilege escalation and device disruption. This exploitation requires at least one Driver to be installed on the device.

Recommendations Update to version 5.6.3.