A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. (CVE-2025-70340)
Description
A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) version 4.21 and earlier within the Alarms comments functionality. Authenticated customer users can manipulate API request parameters to create or modify system-generated alarm comments, enabling unauthorized impersonation of system messages and modification of trusted system-owned data. This results in vertical privilege escalation and potential integrity violations.
CVSS v3.1
Score 6.5medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-70340 describes a Broken Access Control vulnerability in ThingsBoard Professional Edition (PE) 4.21 and below. The flaw resides in the Alarms comments feature, where authenticated users can alter API request parameters to create or modify comments that are normally system-generated. This unauthorized manipulation allows attackers to impersonate system messages and alter trusted data, leading to vertical privilege escalation and compromising data integrity.
Potential Impact
The vulnerability allows authenticated users with limited privileges to escalate their privileges vertically by impersonating system-generated alarm comments and modifying trusted system-owned data. This can undermine the integrity of alarm data and potentially disrupt system operations relying on trusted messages. There is no indication of confidentiality or availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Alarms comments functionality to trusted users only and monitor for suspicious activity related to alarm comment modifications.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-433r-pgvp-mq8p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-70340"]
- State
- PUBLISHED
Threat ID: 6a905423acd9273b4969880c
Added to database: 08/27/2026, 15:13:39 UTC
Last enriched: 09/10/2026, 06:08:25 UTC
Last updated: 10/10/2026, 06:48:14 UTC
Views: 39
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.