CVE-2026-16454 affects Eclipse hawkBit versions up to 1.0.3 and involves a privilege escalation vulnerability (CWE-284 / CWE-862) in the Direct Device Integration Controller. The flaw permits authenticated devices to circumvent strict update boundaries and access any firmware artifact within the same tenant, violating intended access controls. The vulnerability arises from inadequate object-level authorization validation rather than authentication bypass. A related issue in the software modules metadata endpoint allows authenticated devices to enumerate firmware artifacts without assignment enforcement, facilitating potential targeted data exfiltration. The CVSS 3.1 base score is 4.3, indicating medium severity.

An authenticated device within a tenant can escalate its permissions to download any firmware artifact assigned to that tenant, bypassing intended update restrictions. This could lead to unauthorized access to firmware images, potentially exposing sensitive intellectual property or enabling further attacks. The metadata endpoint issue allows enumeration of available firmware artifacts, increasing the risk of targeted exfiltration. There is no indication of impact on confidentiality beyond limited information disclosure, and no impact on integrity or availability is reported.

No official fix or patch is currently available for this vulnerability. Users should monitor the Eclipse Foundation advisories for updates. In the meantime, restrict device authentication to trusted devices only and consider additional network-level controls to limit device access to the update infrastructure. Review and audit device permissions carefully to minimize exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.