Summary
CVE-2026-62853 is a code-execution flaw in ThingLinks, an enterprise IoT platform. It was published to the NVD on October 30, 2026 with a CVSS score of 9.9.
Details
In versions before 1.4.0, the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed Groovy compilation and loading flow. An authenticated attacker can supply code that is compiled and instantiated on the server, running with the privileges of the application.
| Item | Value |
|---|---|
| CVE | CVE-2026-62853 |
| CVSS | 9.9 |
| Vector | Network, authentication required |
| Affected | ThingLinks before 1.4.0 |
| Fixed | ThingLinks 1.4.0 |
Impact
Successful exploitation gives arbitrary code execution on the ThingLinks server, which can expose device data and credentials and provide a foothold into connected IoT and internal networks. Combined with other flaws that yield low-privilege access, the practical barrier is low.
Remediation
- Upgrade ThingLinks to 1.4.0 or later.
- Restrict or block
/groovyScriptTest/paths at the reverse proxy until patched. - Audit accounts for unexpected users and review logs for requests to
/groovyScriptTest/registerScript. - Run the service as a non-privileged user, and isolate it from sensitive network segments.