Description

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T08:17:12.130Z",
  "pubdate": "2026-08-12T08:17:12.130Z",
  "executiveSummary": "An authenticated low-privileged attacker can exploit a SQL injection vulnerability present within an endpoint in the controller's web interface. The affected component utilizes a SQLite database exclusively designated for storing notification messages. Consequently, the operational impact of successful exploitation is strictly constrained to the system's notification functionality. The risk implications involve potential manipulation or unauthorized interaction with stored notification data via maliciously crafted database queries. Exploitation of this vulnerability requires prior authentication with low-level privileges to access the vulnerable web interface endpoint.",
  "technicalDetails": "The vulnerability resides in a specific endpoint within the controller web interface that interfaces with a SQLite database used for notification message storage. The root cause stems from insufficient input sanitization and parameterized query implementation, allowing user-supplied input to directly influence SQL query execution logic. An authenticated attacker possessing low privileges can transmit crafted HTTP requests containing malicious SQL payloads to the vulnerable endpoint. Upon reception, the backend processing logic fails to properly neutralize the input, leading to unauthorized execution of arbitrary SQL commands within the context of the notification SQLite database. Because the database is isolated to notification message storage, the post-exploitation impact is structurally restricted to this subsystem, preventing broader operating system compromise or unauthorized access to other database tables. Attack flow involves authenticating to the controller web interface, identifying the vulnerable notification endpoint, and injecting malicious SQL syntax to interact with the underlying SQLite database engine."
}