CVE-2025-70340: n/a

CVE-2025-70340 describes a Broken Access Control vulnerability in ThingsBoard Professional Edition (PE) version 4.21 and below, specifically in the Alarms comments functionality. Authenticated customer users can manipulate API request parameters to create or modify system-generated alarm comments. This unauthorized modification allows impersonation of system messages and alteration of system-owned data, resulting in vertical privilege escalation and potential integrity breaches. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting data integrity. No patch or official remediation guidance is currently available, and no known exploits in the wild have been reported.

The vulnerability allows an authenticated user with limited privileges to escalate their privileges vertically by impersonating system-generated alarm comments and modifying trusted system data. This compromises the integrity of alarm messages and could mislead system operators or automated processes relying on these alarms. There is no reported impact on confidentiality or availability. No active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the alarm comments functionality to trusted users only and monitor for suspicious activity related to alarm comment modifications. Avoid relying solely on alarm comments for critical system decisions.