CVE-2025-54379 Information

Jul 25, 2025 cve

Description

LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1 there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote attackers to execute arbitrary SQL statements on the underlying SQLite database by manipulating the table name input in an API request. Exploitation can lead to data theft corruption or deletion and full database compromise. This is fixed in version 2.2.1.

Reference

https://github.com/lf-edge/ekuiper/commit/72c4918744934deebf04e324ae66933ec089ebd3 https://github.com/lf-edge/ekuiper/security/advisories/GHSA-526j-mv3p-f4vv

CNNVD-202507-3127 (Published: 2025-07-24)

Share on: