CVE-2025-54379
Published: 24 July 2025
Summary
CVE-2025-54379 is a high-severity SQL Injection (CWE-89) vulnerability in Lfedge Ekuiper. Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 41.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-54379 is a critical SQL injection vulnerability (CWE-89) affecting LF Edge eKuiper, a lightweight IoT data analytics and stream processing engine designed for resource-constrained edge devices. The flaw exists in the getLast API functionality in versions prior to 2.2.1, where attackers can manipulate the table name input in an API request to execute arbitrary SQL statements on the underlying SQLite database. Assigned a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it was published on 2025-07-24.
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By crafting malicious requests to the getLast API endpoint, they can inject SQL payloads, potentially leading to data theft, corruption, deletion, or full compromise of the SQLite database storing eKuiper's data.
The vulnerability is fixed in eKuiper version 2.2.1, as detailed in the project's GitHub security advisory (GHSA-526j-mv3p-f4vv) and the corresponding patch commit (72c4918744934deebf04e324ae66933ec089ebd3). Security practitioners should upgrade to 2.2.1 or later and review API exposures on edge deployments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22548
Vulnerability details
LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw…
more
allows unauthenticated remote attackers to execute arbitrary SQL statements on the underlying SQLite database by manipulating the table name input in an API request. Exploitation can lead to data theft, corruption, or deletion, and full database compromise. This is fixed in version 2.2.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of a public-facing API endpoint via SQL injection in eKuiper's getLast functionality.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation mechanisms for the table name input in the getLast API request to block arbitrary SQL execution.
Ensures timely remediation of flaws like this SQL injection vulnerability through identification, reporting, testing, and patching as implemented in eKuiper 2.2.1.
Enables monitoring of API traffic and database activity to identify exploitation of the getLast endpoint through anomalous SQL queries or unauthorized access patterns.