CVE-2024-43406CWE-89

LF Edge eKuiper has a SQL Injection in sqlKvStore

High · published August 20, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. A user could utilize and exploit SQL Injection to allow the execution of malicious SQL query via Get method in sqlKvStore. This vulnerability is fixed in 1.14.2.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00894 · 59.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-08-20T15:00Z
EPSS history
Timeline
  • 20 AUG 15:00Z
    LF Edge eKuiper has a SQL Injection in sqlKvStore
    cvelistv5