This vulnerability exists in the ThingsBoard provisioning API and enables attackers to inject arbitrary code through the getGatewayDockerComposeFile function. The injected code is executed within the server environment, giving an attacker potential control over the infrastructure. The weakness is classified as CWE-74 (Code Injection) and CWE-94 (Improper Control of Generation of Code). Based on the description it is inferred that an attacker can exploit this remotely, but the attack complexity is high and the overall exploitation difficulty is rated as difficult.

ThingsBoard up to version 4.3.1.1 is affected. No lower‑bound version is specified, but any instance of ThingsBoard 4.3.1.1 or earlier should be considered vulnerable.

The CVSS v3 score of 2.3 places this issue in the low severity range, and the EPSS score is not available. It is not listed in the CISA KEV catalog. Despite the low CVSS, the nature of the vulnerability allows remote code execution, making it potentially high impact if exploited. The attack vector is inferred to be remote, requiring the ability to submit specially crafted requests to the provisioning endpoint. Due to the high attack complexity and difficult exploitation, the likelihood of immediate exploitation is low, but the impact would be severe if successful.