Is there a public PoC exploit available for CVE-2025-34282?

Yes, a public proof-of-concept exploit is available for CVE-2025-34282. Prioritise patching immediately. EPSS: 1.7%.

ThingsBoard CVE-2025-34282

Q: What is the CVSS score of CVE-2025-34282?

CVE-2025-34282 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.7%.

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2025-10-17 disclosure@vulncheck.com

SSRF Thingsboard

6.9

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.1 MEDIUM

Dashboard upload requires login (PR:L); UI:R reflects browser-mediated exploitation path evidenced by CSP fix; scope changed as SSRF reaches subsequent internal systems.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 14, 2026 - 23:31 vuln.today

Analysis Generated

Jul 14, 2026 - 23:31 vuln.today

DescriptionCVE.org

ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may initiate unintended outbound requests. This can be used to access internal services or resources.

AnalysisAI

SVG-based server-side request forgery in ThingsBoard versions prior to 4.2.1 allows upload of crafted SVG files containing external URL references to the dashboard Image Upload Gallery, causing the platform to initiate unintended outbound HTTP requests toward internal network resources. All ThingsBoard deployments (community, professional edition) running versions before 4.2.1 are affected via this gallery feature. No public exploit code or CISA KEV listing exists at time of analysis; however, the upstream fix in PR #13927 - which adds a Content-Security-Policy response header rather than sanitizing SVG content at upload - indicates the primary exploitation path may be browser-mediated rather than purely server-side, warranting scrutiny of the PR:N (no privileges required) CVSS assignment.

Technical ContextAI

ThingsBoard is a Java/Spring-based open-source IoT platform for device management and data visualization. The vulnerability exists within ImageController.java in the image gallery feature (CPE: cpe:2.3:a:thingsboard:thingsboard:*:*:*:*:*:*:*:*). SVG files are XML-based and can embed external resource references via elements such as <image href='...'>, <use xlink:href='...'>, CSS url() references, or <script src='...'>. CWE-918 (Server-Side Request Forgery) indicates the root cause is failure to neutralize outbound requests triggered by user-controlled SVG content before the application or a downstream browser acts on embedded references. Crucially, the fix applied in PR #13927 adds the HTTP response header Content-Security-Policy: default-src 'none' to image download responses rather than stripping external references at upload time. This browser-instruction approach prevents a victim's browser from fetching external URLs when rendering the served SVG, but does not address scenarios where the ThingsBoard server itself parses SVG content and issues outbound requests during processing.

RemediationAI

Upgrade ThingsBoard to version 4.2.1 or later, which incorporates the fix from PR #13927 (https://github.com/thingsboard/thingsboard/pull/13927) adding Content-Security-Policy: default-src 'none' to image serving responses. The release is available at https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1. Prior to patching, apply network-level egress filtering on the ThingsBoard server host to block outbound HTTP/HTTPS connections to RFC 1918 address space (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, 100.100.100.200) - this limits the practical reachability of internal services via SSRF but does not prevent the outbound attempt itself and may break legitimate integrations if ThingsBoard communicates with internal microservices. Additionally, if the image gallery upload endpoint does not require authentication in your deployment, immediately restrict access to the ThingsBoard admin interface to trusted networks or through a VPN/zero-trust gateway, reducing the attack surface significantly.