External risk intelligence

ThingLinks TDS API SQL Injection Affects Data Integrity and Availability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-62849

The vulnerability resides in an API endpoint (/anyUser/tds/insertTableData) within an IoT platform. As an API used for data ingestion in an enterprise platform, this is commonly deployed as a network-accessible service to receive data from remote IoT devices or gateways, making it a likely target for public internet exposure.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts enterprise IoT platforms, specifically the TDengine TDS APIs used for data insertion. It allows unauthenticated attackers to manipulate time-series data, potentially inserting or overwriting critical readings. The primary concern is confirming if your TDengine data insertion flows are exposed and affected.

Unauthenticated attackers can alter IoT data.
This impacts data integrity and system reliability.
Confirm relevance and exposure of data insertion.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted JSON data to the `/anyUser/tds/insertTableData` API. This data, which is not properly validated, is then used to construct SQL queries. This allows the attacker to manipulate TDengine time-series data, leading to unauthorized data insertion or modification.

Unauthenticated network access required.
Triggered by crafted JSON to API.
Can insert or overwrite data.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could tamper with time-series data in the ThingLinks enterprise IoT platform by injecting malicious SQL commands into specific API requests. This could lead to the insertion of unintended data or the overwriting of existing readings within the TDengine database.

Unintended or overwritten time-series data.
Unauthenticated API requests can modify data.
Compromised data integrity for IoT readings.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the TDengine TDS APIs within the ThingLinks enterprise IoT platform, specifically how it handles data insertion requests. Application owners and infrastructure teams are likely responsible for managing this platform. The immediate first step is to identify all instances of the affected technology, determine their exposure and criticality, confirm ownership, and then plan remediation based on risk.

Identify accountable application owners.
Verify TDS API exposure and criticality.
Plan TDengine mapper remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ThingLinks?

ThingLinks is an enterprise IoT platform designed to manage and process data from connected devices. It includes specialized components like the TDengine TDS APIs, which handle the ingestion and storage of time-series data—the streams of measurements typically sent by IoT sensors and gateways.

What is the vulnerability in CVE-2026-62849?

This vulnerability is an SQL injection, classified as CWE-89. In simple terms, the software fails to properly scrub incoming data before using it to build database commands. Because of this, an attacker can send specially formatted messages that trick the system into executing unauthorized database operations rather than just storing the intended sensor data.

How is this vulnerability triggered?

An attacker triggers this by sending malicious JSON content to the specific `/anyUser/tds/insertTableData` API endpoint. The vulnerability is tied to the way the TDS mapper processes these fields; requests that do not target this specific data insertion path or that contain properly structured, benign data will not trigger the flaw.

Is my instance affected by this CVE?

Halo Surface Signal indicates this issue is likely relevant if your instance is internet-facing, as these data ingestion APIs are typically exposed to receive signals from remote devices. If your ThingLinks deployment is isolated from the internet and restricted to internal traffic, the likelihood of unauthorized remote access is significantly reduced.

How do I secure my ThingLinks installation?

The primary response is to update your software to version 1.4.0 or later, which resolves the unsafe SQL construction. You should start by identifying where ThingLinks is deployed in your environment, verifying which instances are running vulnerable versions, and coordinating with your application owners to schedule and apply the update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.