PT-2026-60997 · Sipeed · Picoclaw

Eric-I · CVE-2026-16198 · Published 2026-07-18 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Sipeed PicoClaw versions prior to 0.3.0

Description An authentication bypass exists in the First Run Setup component within the web/backend/middleware/access control.go file. A remote attacker can bypass authentication using an alternate channel by manipulating the allowed cidrs argument. CIDR (Classless Inter-Domain Routing) is a method for allocating IP addresses and routing IP packets.

Recommendations Apply patch 017601354be38cb027ff3ffb01aed79bd5d12610 to resolve the issue.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Improper Authentication

Weakness Enumeration

CWE-288

CWE-287

Related Identifiers

CVE-2026-16198

Affected Products

Picoclaw

References · 10

• 🔥 https://github.com/sipeed/picoclaw/issues/3080 · Exploit
• https://github.com/sipeed/picoclaw/pull/3083 · Patch
• https://github.com/sipeed/picoclaw/commit/017601354be38cb027ff3ffb01aed79bd5d12610 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-16198 · Security Note
• https://vuldb.com/vuln/380014 · Note
• https://twitter.com/VulmonFeeds/status/2078676849274581016 · Twitter Post
• https://vuldb.com/cve/CVE-2026-16198 · Note
• https://vuldb.com/submit/852965 · Note
• https://github.com/sipeed/picoclaw · Note
• https://vuldb.com/vuln/380014/cti · Note