CyberRota Analysis
AI-GeneratedTDengine, a time-series database for IoT devices, contains a vulnerability in the SQL parsing function that allows authenticated users to crash the server by submitting specially crafted SQL queries. This flaw can lead to potential memory leaks, exposing sensitive data. Organizations using versions prior to 3.4.1.14 should prioritize upgrading to mitigate the risk of server crashes and data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\ and read one byte beyond the null terminator, allowing an authenticated user who can submit SQL queries to crash the server and possibly leak adjacent memory. This issue is fixed in version 3.4.1.14.