Six Vulnerabilities Discovered in Eclipse Foundation Eclipse Milo Industrial IoT Library
CVSS scores up to 8.7; flaws in authorization, memory handling, and resource management affect worldwide industrial systems
Key Takeaways
- Six CVEs affect Eclipse Milo 0.6.0 through 1.1.4, covering authorization bypass, memory leaks, and resource mismanagement.
- CVSS scores range from 7.5 to 8.7 (HIGH), with potential impacts including data deletion, credential recovery, user impersonation, and server denial of service.
- All flaws affect industrial automation and IIoT deployments; critical infrastructure sectors listed include Chemical, Critical Manufacturing, Energy, and Water and Wastewater.
- Eclipse Foundation has released Milo 1.1.5 as the first fixed version; legacy 0.6.x users must migrate.
Related Security News
curl Patches HTTP/2 Upload Vulnerability Demonstrating Client-Side Code Execution
The curl project released curl 8.23.0 on October 14, 2026, patching a vulnerability in HTTP/2 upload handling. The issue stems from how curl processes incoming data on the client side when receiving uploads via HTTP/2. A malicious server can send crafted data that corrupts the client's memory. The researcher who reported the flaw demonstrated that under specific build and memory layout conditions, this corruption can be leveraged for client-side code execution. While exploitation requires detailed knowledge of the target's specific build, the researcher's proof-of-concept confirms the theoretical risk of code execution via a malicious server during upload operations.
