CVE-2025-54379

CRITICAL

9.8

Descricao

LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote attackers to execute arbitrary SQL statements on the underlying SQLite database by manipulating the table name input in an API request. Exploitation can lead to data theft, corruption, or deletion, and full database compromise. This is fixed in version 2.2.1.

Detalhes CVE

Pontuacao CVSS v3.19.8

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado7/24/2025

Ultima modificacao10/10/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

lfedge:ekuiper

Fraquezas (CWE)

CWE-89

Referencias

https://github.com/lf-edge/ekuiper/commit/72c4918744934deebf04e324ae66933ec089ebd3(security-advisories@github.com)

https://github.com/lf-edge/ekuiper/security/advisories/GHSA-526j-mv3p-f4vv(security-advisories@github.com)

https://github.com/lf-edge/ekuiper/security/advisories/GHSA-526j-mv3p-f4vv(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.