Live › vulnerability › CVE-2026-62849
ThingLinks, an enterprise IoT platform, has an SQL injection in its TDengine insert endpoint, reachable without logging in. An attacker can insert unintended rows or overwrite existing time-series sensor readings.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 21:25 UTC. All times on this page are UTC.
Deployments of ThingLinks before 1.4.0 that use the TDS module's insert-table-data flow with TDengine. The sources do not say whether the endpoint is exposed by default, so a team should confirm whether it is reachable from untrusted networks. Teams not running ThingLinks or not using the TDengine integration can skip it.
No product ranges from the sources yet.
1.4.0 are affected./anyUser/tds/insertTableData endpoint in your deployment and whether it is reachable from outside your network.1.4.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote unauthenticated attacker can tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The affected surface is the TDS module's insert-table-data flow and TDengine mapper SQL generation. This issue is fixed in version 1.4.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-62849")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.