by Kastro
Paper/Archive/CVE-2025-54379

CVE-2025-54379

lf-edge ekuiper — eKuiper API endpoints handling SQL queries with user-controlled table names.

EPSS 0.9%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 59.0.590 × 2011.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote attackers to execute arbitrary SQL statements on the underlying SQLite database by manipulating the table name input in an API request. Exploitation can lead to data theft, corruption, or deletion, and full database compromise. This is fixed in version 2.2.1.

Affected

ProductAffectedFixed inSource
ekuiper< 2.2.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)8.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/lf-edge/ekuiper/security/advisories/GHSA-526j-mv3p-f4vvrefgithub.com/lf-edge/ekuiper/commit/72c4918744934deebf04e324ae66933ec089ebd3