This vulnerability in Sipeed PicoClaw (versions 0.2.0 to 0.2.9) allows remote attackers to bypass authorization controls by manipulating the argument message.send in the rt.ReloadConfig function of pkg/channels/pico/pico.go. The issue results in missing authorization checks, potentially allowing unauthorized actions. The exploit is publicly known, but no official fix or patch has been documented. The CVSS 4.0 score is 5.3 (medium), reflecting network attack vector, low attack complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.

The vulnerability enables remote attackers to perform unauthorized actions by exploiting missing authorization in a specific function. This could lead to unauthorized configuration reloads or related impacts on the affected system. The CVSS score of 5.3 indicates a moderate impact with limited confidentiality, integrity, and availability effects. No known exploits in the wild have been reported beyond the public exploit availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting network access to the affected service and applying any available access controls to limit exploitation opportunities.