OT Zero-Day Can Take Down a Database Without You Knowing It's There

According to Manufacturing Business Technology, Ridge Security researchers recently discovered CVE-2026-42542, a high-severity vulnerability in TDengine, a time-series database used in industrial IoT, manufacturing, energy, connected vehicles[1] and other sectors that depend on machine and sensor data.The outlet reports that no credentials, session or user interaction are required[1] to carry out the attack. It also says TDengine is also embedded in appliances and other vendor-delivered systems[1].Manufacturing Business Technology says a patch exists, but notes that industrial environments can be difficult to update quickly because of maintenance windows and vendor support requirements[1].Ridge researcher Yan Zhou told the outlet: "This is a one-packet, no-password kill switch on a database that quietly runs a lot of critical infrastructure."[1] Zhou added: "What worries us isn't sophistication, it's location."[1]According to the report, Ridge has not yet observed exploitation or identified any attack IOCs[1]. The outlet says the firm warned that AI-aided vulnerability discovery and chaining have substantially changed the security equation[1].Manufacturing Business Technology reports that the flaw is hard to detect because it produces a crash, not an implant[1]. The outlet says the warning signs include repeated taosd segmentation faults, service restart loops, and anomalous connections to TCP port 6030 from sources outside your known client inventory[1].The IT Nerd blog also reported Ridge's discovery[2] and gave the same details.