CVE-2025-9094: ThingsBoard Add Gateway special elements used in a template engine
A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor replies, that "[t]he fix will come within upcoming release (v4.2) and will be inherited by maintenance releases of LTS versions (starting 4.0)."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9094?
CVE-2025-9094 has been classified with a high severity due to its potential impact on the integrity of the application.
How do I fix CVE-2025-9094?
To mitigate CVE-2025-9094, upgrade ThingsBoard to version 4.1 or later, which includes security patches.
What impact does CVE-2025-9094 have on affected versions?
CVE-2025-9094 allows for improper neutralization of special elements in the template engine, which could lead to unauthorized actions.
Is CVE-2025-9094 remotely exploitable?
Yes, CVE-2025-9094 can be exploited remotely, making it critical to address promptly.
Which versions of ThingsBoard are affected by CVE-2025-9094?
CVE-2025-9094 affects ThingsBoard versions up to and including 4.0.