ThingLinks CVE-2026-62849

Exploitation requires that the ThingLinks TDS module (thinglinks-tds) be deployed and its /anyUser/tds/insertTableData endpoint be network-reachable, with a TDengine time-series backend in use so that attacker-controlled JSON field values flow into the TDengine mapper's SQL generation. Per the CVSS vector (PR:N/UI:N) and the /anyUser/ endpoint prefix, no authentication or user interaction is needed against affected versions below 1.4.0. The main limiting factors are version (fixed in 1.4.0) and exposure of the TDS insert-table-data surface to the attacker; impact is bounded to time-series data tampering and availability rather than reading of other data.

Multiple signals align toward genuine priority but with an important scope caveat. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, consistent with the /anyUser/ endpoint prefix and the vendor's 'unauthenticated' labeling in the GHSA advisory. The vuln.today decision label is act_now, reinforcing urgency. However, the impact is deliberately scoped: the CVSS shows C:N with I:H/A:H, meaning this is a data-tampering and availability issue (inserting/overwriting TDengine time-series readings), not confidentiality loss or code execution - the 9.1 score is driven entirely by integrity and availability, not data theft. No EPSS score was provided, so statistical exploitation probability cannot be weighed. KEV status is not indicated (not listed), so there is no evidence of active exploitation. The references include the fix commit and GHSA advisory but no working exploit code, so this is not a confirmed in-the-wild threat. Net: a real, remotely exploitable unauthenticated SQL injection worth prompt patching per the act_now label, but realistic blast radius is bounded by the niche deployment footprint of ThingLinks and by the integrity/availability-only impact rather than full database compromise.

A remote unauthenticated attacker who can reach the ThingLinks TDS module sends a crafted JSON POST to /anyUser/tds/insertTableData whose field values are passed into unsafe SQL construction in the TDengine TDS mapper. By controlling those field values the attacker injects SQL that inserts unintended rows or overwrites existing time-series readings in TDengine. No public working exploit code was identified in the provided data; the referenced commit is the vendor fix, not an exploit. The AV:N/AC:L/PR:N/UI:N vector means no authentication, user interaction, or special timing is required.