CVE-2026-62849

CriticalCVSS 9.1

Published: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Summary

In ThingLinks before 1.4.0, an unauthenticated SQL injection vulnerability exists in the TDengine TDS APIs. JSON field values submitted to /anyUser/tds/insertTableData reach unsafe SQL construction in the TDS mapper, allowing a remote unauthenticated attacker to tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The issue is fixed in version 1.4.0.

Risk Assessment

An unauthenticated attacker can manipulate measurement data in TDengine, potentially leading to false readings, disrupted analytics, and incorrect operational decisions. This can undermine the integrity of the IoT platform's telemetry data.

Recommendation

Update ThingLinks to version 1.4.0 or later. Until then, restrict network access to the /anyUser/tds/insertTableData endpoint.

Other vulnerabilities in ThingLinks

CVE-2026-62853Critical
In ThingLinks before 1.4.0, the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed compilation and loading flow. An authenticated attacker can supply code that is compiled and executed on the server, leading to remote server-side code execution. The issue affects the rule engine's Groovy script test/register flow and is fixed in version 1.4.0.

Original NVD description (English source)

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe SQL construction in the `TDS mapper`. A remote unauthenticated attacker can tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The affected surface is the TDS module's insert-table-data flow and TDengine mapper SQL generation. This issue is fixed in version 1.4.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS