CVE-2025-54379

CRITICAL

9.8

Description

LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote attackers to execute arbitrary SQL statements on the underlying SQLite database by manipulating the table name input in an API request. Exploitation can lead to data theft, corruption, or deletion, and full database compromise. This is fixed in version 2.2.1.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie7/24/2025

Derniere modification10/10/2025

Sourcenvd

Observations honeypot0

Produits affectes

lfedge:ekuiper

Faiblesses (CWE)

CWE-89

References

https://github.com/lf-edge/ekuiper/commit/72c4918744934deebf04e324ae66933ec089ebd3(security-advisories@github.com)

https://github.com/lf-edge/ekuiper/security/advisories/GHSA-526j-mv3p-f4vv(security-advisories@github.com)

https://github.com/lf-edge/ekuiper/security/advisories/GHSA-526j-mv3p-f4vv(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.