What is the CVSS score of EUVD-2026-53367?

EUVD-2026-53367 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

ChirpStack EUVD-2026-53367

| CVE-2026-71282 MEDIUM

SQL Injection (CWE-89)

2026-08-05 TuranSec

GHSA-9g5q-g36m-7qqq

SQLi PostgreSQL Chirpstack

6.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

PR:L for required device-list auth; C:H for arbitrary DB read via SELECT-path injection; I:N as tag-filter queries expose no write path.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:53 vuln.today

DescriptionCVE.org

ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count() and list()) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format!() macro (dsl::sql::<Bool>(&format!("device.tags->>'{}' =", k)).bind::<Text, _>(v)), while only the tag VALUE is safely parameter-bound via Diesel's .bind(). An authenticated user with device-list access can inject SQL via a crafted tag key when the SQLite backend (chirpstack-sqlite package) is in use; the PostgreSQL backend is unaffected as it uses Diesel's native JSONB containment operator instead of raw SQL string formatting.

AnalysisAI

SQL injection in ChirpStack's SQLite-backend device tag filtering exposes the full database contents to any authenticated user with device-list access. The flaw lives in chirpstack/src/storage/device.rs within both get_count() and list(), where the tag KEY is concatenated into raw SQL via Rust's format!() macro while only the tag VALUE receives safe parameterization through Diesel's .bind(). Only deployments using the chirpstack-sqlite package are affected - the PostgreSQL backend uses Diesel's native JSONB containment operator and is architecturally immune. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

ChirpStack is an open-source LoRaWAN Network Server stack commonly deployed in IoT environments. The vulnerable code uses Diesel ORM's dsl::sql() escape hatch to construct a raw SQL fragment for SQLite JSONB-style key lookup: dsl::sql::<Bool>(&format!("device.tags->>'{}' =", k)).bind::<Text, _>(v). Because SQLite does not support PostgreSQL's native @> JSONB containment operator, the developers adopted a raw-string workaround - but failed to parameterize the key component k, leaving it open to injection. The value v is safely bound via a Diesel parameter placeholder. CWE-89 (SQL Injection) applies precisely: user-controlled input reaches a SQL interpreter without sanitization or parameterization. The CPE string cpe:2.3:a:chirpstack:chirpstack:*:*:*:*:*:*:*:* covers all versions with no lower or upper bound specified.

RemediationAI

No vendor-released patched version has been identified at time of analysis - monitor the upstream repository at https://github.com/chirpstack/chirpstack and the specific file https://github.com/chirpstack/chirpstack/blob/master/chirpstack/src/storage/device.rs for a code fix. The most effective immediate remediation is to migrate from the chirpstack-sqlite backend to the PostgreSQL backend, which is architecturally immune to this vulnerability; this is a configuration-level change but may require data migration effort. If migration is not immediately feasible, restrict device-list access permissions to only trusted, vetted users, since exploitation requires an authenticated account with that specific permission; reducing the pool of eligible attackers limits exposure but does not eliminate the vulnerability. Audit existing ChirpStack SQLite database contents and API access logs for anomalous query patterns that may indicate prior exploitation. The correct code-level fix requires replacing the format!() key interpolation with a Diesel parameterized binding for the key component.