CVE-2026-62849

Summary

ThingLinks IoT platform versions prior to 1.4.0 contain an unauthenticated SQL injection (CWE-89) in the TDengine TDS API endpoint `/anyUser/tds/insertTableData`, where unsanitized JSON field values are used to construct unsafe SQL queries, enabling attackers to tamper with time-series data.

Exploitability

Exploitation is trivial for unauthenticated remote attackers as no authentication or user interaction is required and the vulnerable endpoint accepts arbitrary JSON input.

Blast radius

Successful exploitation allows full compromise of TDengine time-series data integrity, including unauthorized insertion or overwriting of sensor readings, potentially disrupting IoT monitoring and control systems.

Detection

Defenders should monitor for anomalous POST requests to `/anyUser/tds/insertTableData` containing malformed or unexpected JSON structures, especially those with SQL metacharacters (e.g., single quotes, semicolons, `UNION`, `--`) in field values, and correlate with TDengine logs showing unexpected data insertions or overwrites.

Prioritized remediation

Upgrade ThingLinks to version 1.4.0 or later, which contains the official fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.