ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed Groovy compilation and loading flow. An authenticated attacker can provide code that is compiled and instantiated on the server, resulting in arbitrary server-side code execution. The issue affects the rule engine's Groovy script test/register flow. This issue is fixed in version 1.4.0.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…glinks/security/advisories/GHSA-9vph-5ccx-qp9v Diğer
• github.com/…ommit/311ee760dad798f48652722989fcea02349e13a3 Diğer
• github.com/mqttsnet/thinglinks/releases/tag/v1.4.0 Diğer

Kayıt geçmişi

1. 30 Eki 2026 23:28Yayımlandı

İlgili açıklar

• 9,1 CVE-2026-62849ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection
• 7,8 CVE-2026-119335Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypass
• 9,9 CVE-2026-116241pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier
• 8,6 CVE-2026-62284OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
• 9,1 CVE-2026-116852WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability
• 6,5 CVE-2026-102905Ad Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter