CVE-2026-54640

Deferred Deferred - Pending Action

XML External Entity Injection in OpenRemote Platform

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-54640

EUVD

EUVD-2026-98841

Affected Vendors & Products

Vendor	Product	Version / Range
openremote	openremote	< 1.24.2
io.openremote	openremote-manager	< 1.24.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

CVE-2026-54640 is an XML External Entity (XXE) injection vulnerability in OpenRemote's KNX protocol asset import handler. It allows an authenticated attacker to read arbitrary files on the server filesystem by uploading a malicious ZIP file containing specially crafted XML (e.g., 0.xml). The vulnerability exists because the KNXProtocol handler uses unprotected XMLInputFactory and Saxon TransformerFactory instances, unlike the patched Velbus handler.

Detection Guidance

To detect this vulnerability, check if your OpenRemote instance is running a version prior to 1.24.2. Inspect the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java for unprotected XMLInputFactory and Saxon TransformerFactory instances. Look for logs indicating XXE attempts during XML processing of uploaded ETS project ZIP files.

Impact Analysis

An attacker with low-privilege access can exploit this to read sensitive files like /etc/passwd, configuration files with credentials, or internal service endpoints via SSRF. This could lead to unauthorized data exposure, credential theft, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade OpenRemote to version 1.24.2 or later immediately. Ensure the KNXProtocol handler uses secure XML processing methods like createSecureTransformerFactory() and createSecureXmlInputFactory(). Disable external entity resolution in XML parsers and validate XML content before processing.

Hi! I’m here to help you understand CVE-2026-54640. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70