Zero Radar
← feed
CriticalVulnerabilityCVE-2026-62853updated 30 Oct 2026, 21:20 UTC

ThingLinks IoT platform lets logged-in users run code on the server

A user who has a login to the ThingLinks IoT platform can submit a small program that the server then runs itself. That lets them take control of the server, not just the platform's own features.

Fixed in 1.4.0 · out Official source
SeverityCriticalCVSS 9.9 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes1.4.0 · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker logs inAny valid account is enough
  2. 2Submits Groovy scriptSent to the script register endpoint
  3. 3Server compiles scriptNo sandbox limits what it can do
  4. 4Code runs on serverAttacker gains command execution
  5. ResultAttacker controls the server

What happened

In ThingLinks versions before 1.4.0, the /groovyScriptTest/registerScript endpoint compiles and loads user-supplied Groovy scripts in the rule engine without sandboxing, enabling arbitrary server-side code execution by any authenticated user.

Why it is dangerous: An attacker with any valid account can run commands on the server, which can expose or alter device data, rules and credentials, and can be used to move deeper into the network. Enterprise IoT deployments are at risk.

Are you affected?

You are affected if you run ThingLinks versions earlier than 1.4.0 and any user account, including low-privilege ones, can reach the /groovyScriptTest/registerScript endpoint.

ThingLinks, all versions prior to 1.4.0 (rule engine Groovy script test/register flow)

What to do

  1. Upgrade ThingLinks to version 1.4.0 or later
  2. Until upgraded, restrict access to the /groovyScriptTest/registerScript endpoint to trusted administrators
  3. Review the server for unexpected scripts, processes or accounts created after the endpoint was exposed

Timeline

  1. 30 Oct 2026, 21:17 UTC
    Publicly disclosed
  2. 30 Oct 2026, 21:17 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 21:20 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-62853
CVSS
9.9 / 10
Disclosed
30 Oct 2026, 21:17 UTC
On Zero Radar
30 Oct 2026, 21:20 UTC (3 min after disclosure)
Last change
30 Oct 2026, 21:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

ThingLinks IoT platform lets logged-in users run code on the server · Zero Radar