Loading story…
Ridge Security disclosed CVE-2026-42542, a high-severity unauthenticated denial-of-service vulnerability in the open-source TDengine time-series database. An integer-underflow error in pre-authentication RPC message parsing allows an attacker who can reach TCP port 6030 to crash affected servers with a single malformed packet, without credentials.
The flaw affects TDengine versions 3.4.0.0 through 3.4.1.5 and was fixed in version 3.4.1.6 after responsible disclosure. Ridge Security reported no observed in-the-wild exploitation or public exploit code, though it developed and withheld a proof of concept. Organizations using TDengine in industrial telemetry, IoT, energy, utilities, connected vehicles, and other operational environments should upgrade and restrict access to port 6030, as an outage could disrupt monitoring, dashboards, analytics, and historical-data availability.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
TDengine released version 3.4.1.6 to address CVE-2026-42542, which affects versions 3.4.0.0 through 3.4.1.5 and has a CVSS score of 7.5.
Ridge Security discovered CVE-2026-42542, an unauthenticated integer-underflow flaw in TDengine's pre-authentication RPC message parsing, and responsibly reported it to TDengine. A reachable vulnerable server can be crashed with a single malformed packet sent to TCP port 6030.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical command injection vulnerability, tracked as CVE-2025-58428, has been identified in the Veeder-Root TLS4B Automatic Tank Gauge (ATG) System. The flaw resides in the system's SOAP-based web services interface, which allows remote attackers with valid credentials to execute arbitrary system-level commands on the underlying Linux operating system. Successful exploitation could grant attackers full shell access, enable remote command execution, and facilitate lateral movement within affected networks, posing a significant risk to organizations relying on these systems for fuel management and monitoring. Security advisories highlight that all versions of the TLS4B system prior to 11.A are affected. In addition to the command injection issue, the system is also vulnerable to an integer overflow related to Unix time handling, which could cause system resets after the 2038 epoch rollover. The vulnerabilities are rated as critical, with CVSS scores of 9.9 (v3.1) and 9.4 (v4), and could result in denial of service, administrative lockout, or disruption of core functionalities if exploited. Organizations are urged to review vendor guidance and apply mitigations to protect against these threats.
Jun 29, 2026
Researchers disclosed **CVE-2026-32746**, a critical `telnetd` vulnerability in **GNU Inetutils** that allows an unauthenticated remote attacker to achieve **root remote code execution** by exploiting a buffer overflow in the **LINEMODE SLC (Set Local Characters)** option handler. The flaw affects GNU Inetutils `telnetd` through version `2.7`, carries a **CVSS 9.8**, and can be triggered during the initial Telnet handshake on **port 23** before any login prompt appears, requiring no credentials, no user interaction, and no special network position. The issue was discovered and reported by **Dream** on March 11, 2026, and GNU maintainers reportedly confirmed the finding, with a fix expected by **April 1, 2026**. Both reports warn that successful exploitation can lead to full system compromise because `telnetd` often runs with elevated privileges, enabling follow-on activity such as persistent backdoors, data theft, and lateral movement. The risk is especially acute in **legacy environments** where Telnet remains in use, including **ICS/OT, PLC, SCADA, and some government systems**, even though public reporting has not yet indicated active exploitation in the wild.
Jul 1, 2026
Two critical vulnerabilities have been discovered in Red Lion Sixnet remote terminal units (RTUs), which are widely deployed in industrial control systems across sectors such as energy, water and wastewater treatment, transportation, utilities, and manufacturing. The vulnerabilities, identified as CVE-2023-42770 and CVE-2023-40151, both carry the maximum CVSS score of 10.0, indicating their severity and potential for exploitation. CVE-2023-42770 is an authentication bypass flaw that arises because the affected RTUs only enforce authentication on UDP port 1594, while the same port over TCP does not require authentication, allowing attackers to send unauthorized commands. CVE-2023-40151 is a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary Linux shell commands as root via the Sixnet Universal protocol. These vulnerabilities can be chained, enabling a remote attacker to bypass all authentication and gain full control over the RTU, potentially leading to significant disruptions in critical infrastructure operations. The flaws were discovered by Claroty’s Team82, who withheld full exploit details to give organizations time to patch their systems. Red Lion’s Sixnet IO Tool Kit, a Windows-based utility, is used to configure these RTUs and communicates using a proprietary protocol that was found to be susceptible to these attacks. The vulnerabilities affect both the SixTRAK and VersaTRAK series of RTUs. The user-permission system implemented in the protocol was intended to restrict access, but the lack of authentication checks on TCP traffic undermines this security measure. Security experts have warned that exploitation of these vulnerabilities could allow attackers to manipulate, disrupt, or destroy industrial processes controlled by the compromised RTUs. The affected devices are integral to automation, control, and data acquisition in industrial environments, making the risk of exploitation particularly concerning. Organizations using these RTUs are urged to apply available patches and review network segmentation to limit exposure. The vulnerabilities highlight the ongoing risks associated with legacy industrial protocols and the importance of rigorous security testing in critical infrastructure environments. Claroty’s report provides technical details on the flaws and emphasizes the need for immediate remediation. The disclosure underscores the potential for unauthenticated remote attacks to have far-reaching impacts on essential services. Security professionals recommend monitoring for unusual network activity on port 1594 and implementing strict access controls. The incident serves as a reminder of the critical need for robust authentication and secure protocol design in industrial control systems.
Jul 12, 2026