CVE-2026-54640High· 7.6▾ TwilightOpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's upl…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
io.openremote:openremote-agent <= 1.24.1Patched in:
io.openremote:openremote-agent 1.24.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54641High· 7.7OpenRemote is an open-source internet-of-things platform
CVE-2026-49439Medium· 4.3OpenRemote is an open-source internet-of-things platform
CVE-2026-116185Medium· 5.0OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos
CVE-2026-116186Low· 2.3OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId
CVE-2026-116184Low· 2.1OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
CVE-2026-114661High· 8.5OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints