{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/kura-5.0.0-through-5.6.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:eclipse:kura:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:kura:5.6.2:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-113422"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kura (5.0.0 through 5.6.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Eclipse"],"content_html":"\u003cp\u003eEclipse Kura versions 5.0.0 through 5.6.2 are vulnerable to an authenticated privilege escalation issue within the Wire Graph update functionality of the Kura Web UI and the Wire Service REST API v1. An authenticated identity with limited permissions (kura.wires.admin or rest.wires.admin) can provide a manipulated factory identifier in a configuration request. The system incorrectly trusts this identifier to determine the target component, allowing the user to modify or replace security-relevant components outside the intended Wire Graph. This vulnerability requires at least one Driver to be installed on the device.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user with restricted Wires management privileges to gain full administrative control over the Eclipse Kura device or cause operational disruption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Eclipse Kura to version 5.6.3 or later immediately to remediate CVE-2026-113422.\u003c/li\u003e\n\u003cli\u003eRestrict access to the Kura Web UI and Wire Service REST API to trusted administrative accounts only.\u003c/li\u003e\n\u003cli\u003eAudit existing user permissions to ensure the 'kura.wires.admin' and 'rest.wires.admin' roles are assigned only to authorized personnel.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T16:59:48Z","date_published":"2026-11-10T16:59:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-eclipse-kura-privilege-escalation/","summary":"Eclipse Kura versions 5.0.0 through 5.6.2 contain a vulnerability in the Wire Graph update functionality that allows an authenticated user with low-level administrative permissions to escalate to full administrative control.","title":"Eclipse Kura: Authenticated privilege escalation via Wire Service REST API (CVE-2026-113422)","url":"https://feed.craftedsignal.io/briefs/2026-11-eclipse-kura-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Kura (5.0.0 Through 5.6.2)","version":"https://jsonfeed.org/version/1.1"}