PT-2026-60648 · Openremote · Openremote

Aramosf · CVE-2026-62238 · Publicado 2026-07-17 · Atualizado 2026-07-17

NVD

CVSS v4.0

7.2

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-62238

Produtos afetados

Openremote

Referências · 3

• https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-62238 · Nota de Segurança
• https://vulncheck.com/advisories/openremote-sql-injection-via-crosstab-export · Nota