PT-2026-57047 · Sipeed · Picoclaw

Eric-I · Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-15320

NVD

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of the file pkg/channels/pico/pico.go. Performing a manipulation of the argument message.send results in missing authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. The reported GitHub issue was closed automatically due to inactivity.

Exploit

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2026-15320

Affected Products

Picoclaw

References · 7

• 🔥 https://github.com/sipeed/picoclaw/issues/3071 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-15320 · Security Note
• https://vuldb.com/vuln/377260 · Note
• https://github.com/sipeed/picoclaw · Note
• https://vuldb.com/submit/852942 · Note
• https://vuldb.com/cve/CVE-2026-15320 · Note
• https://vuldb.com/vuln/377260/cti · Note