Code Execution Vulnerability in OpenRemote IoT Platform
CVE-2026-54640

7.6HIGH

Key Information:

Vendor

Openremote

Status
Openremote
Openremote-manager
Vendor
CVE Published:
13 October 2026

What is CVE-2026-54640?

The OpenRemote IoT Platform has a code execution vulnerability in the KNXProtocol that allows a specially crafted ETS project ZIP file to be processed in a way that enables unauthorized users to access files on the server. This vulnerability stems from external entity resolution vulnerabilities within the Saxon TransformerFactoryImpl and XMLInputFactory parsers used in the asset import method. While the Velbus handler has undergone remediation, the KNX handler remains exposed, potentially allowing an attacker to issue server-side requests or read sensitive files accessible to the JVM process. Users are encouraged to upgrade to version 1.24.2 or later to mitigate this risk.

Affected Version(s)

openremote < 1.24.2

openremote-manager < 1.24.2

References

https://github.com/openremote/core/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/openremote/core/commit/c28d3c60ebc2da6...
x_refsource_MISC
https://github.com/openremote/core/releases/tag/1.24.2
x_refsource_MISC

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.