CVE-2025-70340: ThingsBoard ThingsBoard Professional Edition (PE) vulnerability
A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows unauthorized impersonation of system messages and modification of trusted system-owned data, resulting in vertical privilege escalation and potential integrity violations.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated customer user can exploit it. The issue is in the Alarms comments functionality of ThingsBoard Professional Edition.
What does exploitation require?
The attacker needs to manipulate parameters in the relevant API request. Successful exploitation allows creation or modification of system-generated alarm comments.
Which versions are affected?
ThingsBoard Professional Edition 4.21 and below are affected.
What is the security impact?
An attacker can impersonate system messages and alter trusted system-owned alarm-comment data. This can result in vertical privilege escalation and integrity violations.