CVE-2026-15318 | A weakness has been identified in Sipeed PicoClaw up to 0.2.… | CVSS 6.3 MEDIUM

Description

A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument client_id causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

Metadata

CVE ID: CVE-2026-15318
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-09 18:07 UTC
Published: 2026-07-10 01:30 UTC
Last updated: 2026-07-10 01:30 UTC
Primary CWE: CWE-863
Incorrect Authorization
Vendor / Product: Sipeed / PicoClaw
Sources: cve.org · NVD

Severity & Metrics

6.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
Sipeed	PicoClaw	—	0.2.0, 0.2.1, 0.2.2, 0.2.3 …

Weakness (CWE)

CWE	Source	Description
CWE-285	cna	Improper Authorization
CWE-863	cna	Incorrect Authorization

CVSS scores (4)

Score	Severity	Version	Source	Vector
6.5	N/D	2.0	cna	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
6.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.3	MEDIUM	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References (6)

VDB-377258 | Sipeed PicoClaw MQTT Channel mqtt.go authorization https://vuldb.com/vuln/377258
VDB-377258 | CTI Indicators (IOB, IOC, IOA) https://vuldb.com/vuln/377258/cti
CVE-2026-15318 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-15318
Submit #852879 | Sipeed PicoClaw <= 0.2.9 Incorrect Authorization (CWE-863) https://vuldb.com/submit/852879
https://github.com/sipeed/picoclaw/issues/3068
https://github.com/sipeed/picoclaw/