This vulnerability affects the MQTT Channel Handler component in Sipeed PicoClaw versions 0.2.0 through 0.2.9. The flaw arises from improper authorization checks related to the client_id argument in the file pkg/channels/mqtt/mqtt.go. An attacker can remotely manipulate this argument to bypass authorization controls. Although an exploit is publicly available, there is no vendor-provided fix or mitigation at this time. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity.

Successful exploitation of this vulnerability could allow remote attackers to bypass authorization mechanisms in the MQTT Channel Handler, potentially leading to unauthorized access or actions within the affected system. The exact impact depends on how the MQTT Channel Handler is used within the environment. There are no known exploits in the wild beyond the publicly available proof-of-concept.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently available, users should monitor vendor communications for updates. Until a patch is released, consider restricting network access to the MQTT service and applying compensating controls to limit exposure.