CVE-2026-6987
HIGHPicoClaw Web Launcher Management Plane restart command injection
Title source: cnaDescription
A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management Plane. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
References (4)
Core 4
Core References
Vdb Entry vdb-entry
VDB-359530 | PicoClaw Web Launcher Management Plane restart command injection
https://vuldb.com/vuln/359530
Signature, Permissions Required signature
permissions-required
VDB-359530 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/359530/cti
Third Party Advisory third-party-advisory
Submit #796336 | PicoClaw V0.2.4 Command execution
https://vuldb.com/submit/796336
Issue Tracking issue-tracking
https://github.com/sipeed/picoclaw/issues/2307
Scores
CVSS v3
7.3
EPSS
0.0313
EPSS Percentile
86.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-74
CWE-77
Status
published
Products (7)
None/PicoClaw
0.2.0
None/PicoClaw
0.2.1
None/PicoClaw
0.2.2
None/PicoClaw
0.2.3
None/PicoClaw
0.2.4
sipeed/picoclaw
< 0.2.4
sipeed/picoclaw
0 - 0.2.4Go
Published
Apr 25, 2026
Tracked Since
Apr 25, 2026