EUVD-2026-62438
GHSA-2gj8-9c9g-jr53
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N); full database read/write and destructive DDL justify C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
3DescriptionCVE.org
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injection.
This issue affects FAYDAM Datalogger: from 2.7.1 before 2.8.0.
AnalysisAI
SQL injection in FAYDAM Datalogger (versions 2.7.1 up to but not including 2.8.0) lets remote attackers inject arbitrary SQL commands through improperly neutralized input, per a TR-CERT advisory. With a CVSS vector of PR:N/UI:N, exploitation requires no authentication or user interaction, exposing the backing database to full read, modification, and destruction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions - remote unauthenticated exploitation over the network against FAYDAM Datalogger versions 2.7.1 through 2.7.x, requiring only reachability to the vulnerable input parameter. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with high impact across confidentiality, integrity, and availability - the archetype of a high-priority SQLi. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to FAYDAM Datalogger 2.8.0 or later, which is the first version outside the affected range - Vendor-released patch: 2.8.0 (per the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0871). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all FAYDAM Datalogger deployments running versions 2.7.1-2.7.x in production, development, and test environments; identify which systems are internet-accessible or connected to untrusted networks; and immediately restrict network access to these systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today