Technical impact
TDengine is a time‑series database for Internet of Things devices. In versions prior to 3.4.1.15 an attacker who possesses the "create udf" privilege can upload a malicious shared library and register it as a user‑defined function, such as an eval function. The library is then executed on the TDengine server as part of normal database queries, allowing the attacker to run arbitrary C code on the host. This flaw is a classic example of code injection (CWE‑94) and grants the attacker full control over the server, compromising confidentiality, integrity, and availability of the system.
Affected Systems
The vulnerability affects all deployments of taosdata’s TDengine that are running any version older than 3.4.1.15. No other vendors or product lines are listed as impacted.
Risk and Exploitability
The CVSS base score of 7.2 indicates a high severity for remote attacks. The EPSS score of less than 1% suggests that, at present, the likelihood of this vulnerability being exploited in the wild is low, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote database connection where the attacker has been granted the create udf privilege, enabling the upload and execution of a malicious library through ordinary query traffic. Although the exploitation requirements are specific, the resulting compromise would be full system takeover.
