eclipse hawkbit vulnerabilities

Latest eclipse hawkbit CVEs

Newest publication first

1. CVE-2026-16454 Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration

   Published 2026-07-21

   Medium·CVSS 4.3

   In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundar...

2. CVE-2020-27219 Cross-site Scripting in Eclipse Hawkbit

   Published 2021-01-14

   Medium·CVSS 6.1 EPSS 0.84%

   In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescap...

3. CVE-2019-10240 Cleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit

   Published 2019-04-03

   High·CVSS 8.1 EPSS 0.43%

   Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.