CVE-2025-9094
BaseFortify
Publication date: 2025-08-17
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| thingsboard | thingsboard | 4.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1336 | The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. |
| CWE-791 | The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in ThingsBoard 4.1 affects the Add Gateway Handler component, where improper neutralization of special elements used in a template engine allows an attacker to manipulate the system remotely. This means that special characters or code elements are not properly handled, potentially enabling malicious input to be executed or processed in unintended ways.
How can this vulnerability impact me? :
The vulnerability can be exploited remotely to manipulate the template engine, which may lead to unintended behavior or security issues within the affected ThingsBoard system. Although the exact impact is not detailed, such vulnerabilities typically risk data integrity or system stability. The vendor plans to fix this in version 4.2 and subsequent maintenance releases.
What immediate steps should I take to mitigate this vulnerability?
The vendor has stated that a fix will be included in the upcoming ThingsBoard release v4.2 and maintenance releases of LTS versions starting from 4.0. Until the fix is available, it is recommended to monitor for updates from the vendor and apply the patch as soon as it is released. Additionally, consider limiting remote access to the affected component and applying general security best practices to reduce exposure.