CVE-2025-54379 in ekuiper
Summary
by MITRE • 07/25/2025
LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote attackers to execute arbitrary SQL statements on the underlying SQLite database by manipulating the table name input in an API request. Exploitation can lead to data theft, corruption, or deletion, and full database compromise. This is fixed in version 2.2.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2025
The LF Edge eKuiper project represents a critical component in edge computing environments where lightweight data analytics and stream processing are essential for IoT device operations. This vulnerability affects versions prior to 2.2.1 and specifically targets the getLast API functionality which serves as a data retrieval mechanism for edge devices operating under resource-constrained conditions. The vulnerability exists within the database interaction layer where user-supplied table name parameters are not properly sanitized or validated before being incorporated into SQL queries. This flaw demonstrates a classic SQL injection vulnerability that exploits improper input handling in database access functions.
The technical exploitation of this vulnerability occurs through manipulation of the table name parameter within API requests to the getLast endpoint. Attackers can craft malicious table names containing SQL payload sequences that bypass normal input validation mechanisms and directly influence the underlying SQLite database query execution. This represents a severe authorization bypass where unauthenticated remote attackers can leverage the vulnerability to execute arbitrary SQL commands without requiring valid credentials or access permissions. The attack surface is particularly concerning in edge computing environments where devices may be deployed in unsecured locations and lack robust network segmentation controls.
The operational impact of this vulnerability extends beyond simple data compromise to encompass complete database system compromise. Successful exploitation enables attackers to perform data theft operations by extracting sensitive information from the SQLite database, implement data corruption through malicious update operations, or execute destructive deletion commands that can render the edge device data processing capabilities non-functional. The vulnerability's critical severity classification stems from the fact that it affects the core database functionality of the eKuiper engine, potentially disrupting IoT data processing pipelines and compromising the integrity of edge analytics workflows. This vulnerability directly maps to CWE-89 which specifically addresses SQL injection flaws in software applications.
Organizations utilizing LF Edge eKuiper in production edge computing environments must implement immediate mitigation strategies to protect their IoT infrastructure from potential exploitation. The primary recommended action involves upgrading to version 2.2.1 or later which includes proper input validation and parameterized query execution mechanisms that prevent malicious SQL payloads from being executed. Network segmentation and access control measures should be implemented to limit exposure of the affected API endpoints to trusted networks only. Additionally, monitoring and logging should be enhanced to detect unusual API request patterns that may indicate exploitation attempts. From an ATT&CK framework perspective, this vulnerability aligns with techniques involving command and control communications and privilege escalation through database access, making it particularly dangerous in environments where edge devices serve as critical data processing nodes in broader IoT ecosystems.