Zero Radar
← feed
CriticalVulnerabilityCVE-2026-62849updated 30 Oct 2026, 21:20 UTC

ThingLinks IoT platform: unauthenticated attackers can tamper with sensor data

Anyone on the internet can send a specially crafted request to the platform and change the time-series sensor readings it stores, without logging in. Attackers could insert fake readings or overwrite real ones.

Fixed in ThingLinks 1.4.0 · out Official source
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesThingLinks 1.4.0 · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login or account needed
  2. 2Crafted requestSent to insertTableData endpoint
  3. 3TDS mapperJSON values build unsafe SQL
  4. 4TDengine databaseInjected SQL runs against time-series data
  5. ResultSensor data inserted or overwritten

What happened

An SQL injection flaw in the TDengine TDS insert-table-data API (/anyUser/tds/insertTableData) lets request JSON field values flow unsafely into SQL generated by the TDS mapper, with no authentication required.

Why it is dangerous: Operators relying on IoT readings for monitoring, billing, or safety decisions could receive false or altered data, and attackers may be able to hide or distort real events. Organizations running exposed ThingLinks deployments are at risk.

Are you affected?

You are affected if you run ThingLinks versions before 1.4.0 with the TDengine TDS API module reachable over the network.

ThingLinks, all versions prior to 1.4.0 (TDengine TDS APIs / TDS mapper)

What to do

  1. Update ThingLinks to version 1.4.0 or later
  2. Until patched, block external access to /anyUser/tds/insertTableData at the firewall or reverse proxy
  3. Review TDengine time-series data for unexpected inserted rows or overwritten readings

Timeline

  1. 30 Oct 2026, 21:17 UTC
    Publicly disclosed
  2. 30 Oct 2026, 21:17 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 21:20 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-62849
CVSS
9.1 / 10
Disclosed
30 Oct 2026, 21:17 UTC
On Zero Radar
30 Oct 2026, 21:20 UTC (3 min after disclosure)
Last change
30 Oct 2026, 21:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

ThingLinks IoT platform: unauthenticated attackers can tamper with sensor data · Zero Radar