Critical Vulnerability in TDengine Affects Industrial Systems

• •CVE-2026-42542 allows unauthenticated remote crashes of TDengine servers.
• •The vulnerability affects numerous sectors, including industrial and IoT environments.
• •Organizations are urged to upgrade to TDengine version 3.4.1.6 and restrict access to port 6030.

A high-severity zero-day vulnerability, CVE-2026-42542, has been disclosed in TDengine, a time-series database widely used in industrial and IoT environments. This flaw allows unauthenticated attackers to crash affected servers with a single specially crafted network packet. The vulnerability affects TDengine versions 3.4.0.0 through 3.4.1.5, with a CVSS score of 7.5. Organizations using TDengine for critical operations, such as manufacturing and energy, are at risk, especially if the database is on a flat network. Although no exploitation in the wild has been confirmed, Ridge Security has developed a proof-of-concept exploit. TDengine has released a fixed version (3.4.1.6) and recommends organizations upgrade and restrict access to the default RPC port 6030. The vulnerability was discovered by Ridge Security during testing of open-source applications.