CVE-2026-16454

Name of the Vulnerable Software and Affected Versions Eclipse hawkBit versions prior to 1.0.3

Description A privilege escalation issue exists in the Direct Device Integration (DDI) Controller due to a flaw in object-level authorization validation. This allows an authenticated device with valid tenant credentials to bypass restrictions and download any firmware artifact within the same tenant, rather than being limited to specifically assigned updates. Additionally, the listing software modules artifacts metadata endpoint fails to enforce assignment checks, allowing authenticated devices to enumerate available firmware artifacts and facilitate targeted exfiltration.

Recommendations Update to a version newer than 1.0.3.