Cpe:2.3:a:eclipse:kura:5.6.2:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aeclipsekura5.6.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 16:59:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgEclipse Kura: Authenticated privilege escalation via Wire Service REST API (CVE-2026-113422)https://feed.craftedsignal.io/briefs/2026-11-eclipse-kura-privilege-escalation/Tue, 10 Nov 2026 16:59:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-eclipse-kura-privilege-escalation/Eclipse Kura versions 5.0.0 through 5.6.2 contain a vulnerability in the Wire Graph update functionality that allows an authenticated user with low-level administrative permissions to escalate to full administrative control.Eclipse Kura versions 5.0.0 through 5.6.2 are vulnerable to an authenticated privilege escalation issue within the Wire Graph update functionality of the Kura Web UI and the Wire Service REST API v1. An authenticated identity with limited permissions (kura.wires.admin or rest.wires.admin) can provide a manipulated factory identifier in a configuration request. The system incorrectly trusts this identifier to determine the target component, allowing the user to modify or replace security-relevant components outside the intended Wire Graph. This vulnerability requires at least one Driver to be installed on the device.

Impact

Successful exploitation allows an authenticated user with restricted Wires management privileges to gain full administrative control over the Eclipse Kura device or cause operational disruption.

Recommendation

  • Upgrade Eclipse Kura to version 5.6.3 or later immediately to remediate CVE-2026-113422.
  • Restrict access to the Kura Web UI and Wire Service REST API to trusted administrative accounts only.
  • Audit existing user permissions to ensure the 'kura.wires.admin' and 'rest.wires.admin' roles are assigned only to authorized personnel.
]]>highadvisory