Someone can unplug your security cameras with a single ping, and the cameras happen to watch the reactor floor
CVE-2026-42542 is an integer underflow in TDengine's uvConnMayGetUserInfo() function, present in versions 3.4.0.0 through 3.4.1.5. When a crafted RPC packet arrives on TCP port 6030 with a msgLen field smaller than the expected header size (64 or 192 bytes), the unsigned subtraction wraps to a near-2^64 value. That impossibly large length is fed to memcpy(), which immediately segfaults and kills the taosd process. No credentials, no session, no user interaction — one packet, one crash. The underlying mechanic is actually a heap buffer overflow driven by an attacker-influenced length, which Ridge Security notes *could* theoretically evolve toward RCE, though only DoS is confirmed today.
The vendor's HIGH / 7.5 rating is honest and, for TDengine's canonical deployment profile, fair. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the unauthenticated, zero-complexity, availability-only impact. Where vendors sometimes over-rate to cover themselves, here the score actually *under-represents* the operational reality for OT/ICS deployments: TDengine markets itself as a drop-in replacement for OSIsoft PI, and losing your historian during an industrial incident means losing your eyes on the process. We hold the verdict at HIGH but nudge the score to 7.0 because the confirmed impact ceiling is still DoS — not code execution, not data theft, not lateral movement.
4 steps from start to impact.
Reach TCP 6030
taosd RPC port, which defaults to 6030. In OT/ICS environments, this port serves internal telemetry clients and is typically behind a DMZ or plant-floor VLAN — but segmentation discipline varies wildly. In cloud-hosted TDengine instances, the port may be bound to a public interface if the operator followed quick-start docs naively.- Network path to taosd TCP 6030
- Well-segmented OT networks restrict 6030 to SCADA/historian VLAN only
- Cloud deployments behind TDengine Cloud do not expose raw RPC
- Enterprise firewalls should block custom binary protocols from untrusted zones
Send a malformed RPC packet
msgLen field set below the mandatory header size. The protocol is binary and custom, but the header structure is documented in TDengine's open-source code. No authentication handshake is required before the vulnerable code path is reached — uvConnMayGetUserInfo() fires on the raw packet before any credential check.- Knowledge of TDengine RPC binary framing (open source)
- Ability to send arbitrary TCP payload
- The RPC protocol is niche — no off-the-shelf exploit frameworks include a module yet
- Ridge Security holds a working PoC but has not published it
Integer underflow triggers heap overflow
uvConnMayGetUserInfo(), the subtraction msgLen - headerSize underflows because msgLen < headerSize. The result — a massive unsigned value — is passed as the length argument to memcpy(). The copy overruns the heap buffer, hits an unmapped page, and the kernel delivers SIGSEGV to the taosd process.- Vulnerable TDengine version (3.4.0.0–3.4.1.5)
- Modern ASLR and heap layout make controlled exploitation for RCE non-trivial
- Only DoS is confirmed; no known RCE chain exists
uvConnMayGetUserInfo.taosd crashes — historian goes dark
taosd process terminates. All active client connections drop. Ingest pipelines stall, dashboards go blank, and any alerting rules that depend on TDengine data stop evaluating. In OT environments this means operators lose real-time process telemetry. The attacker can repeat the packet to prevent recovery, creating a sustained outage for as long as they maintain network access.- Steps 1–3 succeeded
- Systemd can auto-restart taosd, but the attacker can re-crash it faster than the restart cycle
- Clustered TDengine deployments (dnodes) may survive loss of one node if queries can fail over
The supporting signals.
| In-the-Wild Exploitation | No confirmed exploitation. Not listed in CISA KEV. Ridge Security disclosed this through coordinated disclosure in June 2026; no campaigns observed as of September 2026. |
|---|---|
| Proof of Concept | Private PoC held by Ridge Security. Their Threat Research Team confirmed a working crash exploit but has not published code. The open-source nature of TDengine means independent reproduction is straightforward for anyone who reads the diff of commit 003e8a5f. |
| EPSS Score | 0.00633 — low probability of exploitation in the next 30 days. Reflects the niche protocol and lack of public PoC tooling. |
| KEV Status | Not listed. No CISA KEV entry as of 2026-09-25. |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) — Network-reachable, zero complexity, no auth, availability-only. The S:U (Unchanged scope) is correct; the crash is confined to the taosd process. |
| Affected Versions | TDengine 3.4.0.0 through 3.4.1.5 (introduced in commit 6e95fe58, fixed in 003e8a5f). |
| Fixed Versions | 3.4.1.6 and all later releases. No distro backports apply — TDengine is distributed via its own packages and Docker images, not OS repos. |
| Internet Exposure | TDengine's RPC protocol on TCP 6030 is binary and custom — Shodan and Censys do not have dedicated fingerprinting for it. Direct internet exposure is likely low but unmeasured. The 730k+ reported running instances are overwhelmingly behind firewalls in OT/plant networks. |
| Disclosure Timeline | Disclosed 2026-06-10 via coordinated disclosure. GHSA-vg95-j2hf-hvjx published. Fix shipped in TDengine 3.4.1.6 release. |
| Researcher / Org | Ridge Security Threat Research Team — discovered through source and binary-level auditing of TDengine's RPC handling code. |
Sources.
Why this verdict
- Unauthenticated, zero-complexity crash: The attack requires one TCP packet with no credentials. The CVSS base score of 7.5 fairly captures this — no friction-based downgrade is warranted on the access-complexity axis.
- DoS-only confirmed impact caps the ceiling: Despite the underlying heap overflow mechanic, no RCE chain exists. Confidentiality and integrity are unaffected. This prevents an upgrade to CRITICAL on impact grounds alone.
- Network exposure friction applies a modest downward adjustment: Port 6030 speaks a custom binary protocol and should never be internet-facing. In properly segmented OT networks, the attacker must already be on the historian VLAN. This narrows the reachable population and justifies a 0.5-point reduction from the vendor's 7.5 to 7.0.
- Role multiplier: OT/ICS/SCADA historian (high-value role). TDengine is *canonically* an IIoT/SCADA data historian — it replaces OSIsoft PI and is marketed explicitly for industrial telemetry. Well over 10% of its 730k+ installed base serves this role. The chain succeeds fully in this role (one packet → historian down → loss of process visibility). Blast radius is host→service→operational-visibility. In a coordinated OT attack, blinding the historian enables the physical-process manipulation stage — this is the Industroyer/TRITON playbook. This constitutes plausible OT-safety impact, setting a verdict floor of HIGH. The floor prevents any downgrade below HIGH regardless of network segmentation friction.
- Role multiplier: general IT analytics/monitoring (typical role). For non-OT deployments (DevOps metrics, business analytics), the blast radius is service-level. A restart recovers the system. This role alone would justify MEDIUM, but the OT floor dominates.
Why not higher?
The confirmed impact is availability-only — no code execution, no data exfiltration, no lateral movement, no persistence. While the heap overflow *could* theoretically evolve toward RCE, no such chain exists today. CRITICAL requires either confirmed RCE in a canonical high-value component or a domain/fleet/supply-chain outcome, and a DoS on a single service — even an OT historian — does not cross that threshold without a demonstrated path to process manipulation.
Why not lower?
TDengine is a canonical OT/ICS component with 730k+ instances, heavily deployed as the SCADA data historian. The unauthenticated, zero-complexity, one-packet crash is trivially reproducible once the PoC is reverse-engineered from the public patch diff. Sustained exploitation prevents recovery. In OT environments, loss of the historian during an active incident is a safety-relevant condition — operators cannot see process variables. The HIGH floor set by the OT-safety role multiplier cannot be broken by network-segmentation arguments alone, especially given that OT network segmentation is notoriously inconsistent in practice.
Restart=on-failure with RestartSec=5 and StartLimitBurst=10 in the taosd systemd unit. Pair with an alert on restart count exceeding 3 in 60 seconds. This does not prevent the crash but limits sustained outage duration and gives your SOC a signal. Deploy within 30 days.uvConnMayGetUserInfo() before the subtraction. This eliminates the vulnerability entirely. Per the noisgate remediation SLA for HIGH severity, complete within 180 days. Prioritize OT/production instances first.- WAF or reverse proxy in front of port 6030 — TDengine's RPC protocol is a custom binary format, not HTTP. No WAF can inspect or filter it meaningfully. Putting an HTTP reverse proxy in front will simply break the protocol.
- TDengine authentication configuration — The vulnerable code path (
uvConnMayGetUserInfo) executes *before* authentication is checked. Enabling or strengthening TDengine auth does not prevent the crash. - TLS/encryption on the RPC channel — While TDengine supports TLS for its RPC connections, the malformed packet still reaches the vulnerable parsing code after TLS termination. Encryption protects confidentiality, not input validation.
Crowdsourced verification payload.
Run this script on each TDengine server host where taosd is installed. No special privileges required — it reads the binary version only. Invoke with: bash cve-2026-42542-check.sh
#!/usr/bin/env bash
# CVE-2026-42542 version checker for TDengine taosd
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -euo pipefail
VULN_START="3.4.0.0"
VULN_END="3.4.1.5"
FIXED="3.4.1.6"
version_to_int() {
local IFS='.'
local parts=($1)
printf '%d%03d%03d%03d' "${parts[0]}" "${parts[1]}" "${parts[2]}" "${parts[3]}"
}
if ! command -v taosd &>/dev/null; then
echo "UNKNOWN - taosd binary not found in PATH."
echo "If TDengine is installed in a non-standard location, add it to PATH and re-run."
exit 2
fi
VER=$(taosd -V 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)
if [ -z "$VER" ]; then
echo "UNKNOWN - could not parse taosd version string."
exit 2
fi
VER_INT=$(version_to_int "$VER")
START_INT=$(version_to_int "$VULN_START")
END_INT=$(version_to_int "$VULN_END")
if [ "$VER_INT" -ge "$START_INT" ] && [ "$VER_INT" -le "$END_INT" ]; then
echo "VULNERABLE - taosd $VER is in affected range ($VULN_START - $VULN_END)."
echo "Upgrade to >= $FIXED to remediate CVE-2026-42542."
exit 1
else
echo "PATCHED - taosd $VER is outside the affected range."
exit 0
fi