CVE-2026-114358 SQL Injection Vulnerability in Radius Xenia M2M Platform

CriticalCVSS 9.3 EPSS 0.50%

Published: 2026-10-29 10:53
Updated: 2026-10-29 17:45
Exploit status: No public exploit known

Description

This
vulnerability exists in the Radius
Xenia M2M Platform due to insufficient validation of user supplied input in
the password recovery functionality in the web management interface. An
unauthenticated remote attacker could exploit this vulnerability by supplying
crafted SQL query through input fields to the targeted system.

Successful exploitation of this vulnerability
could allow the attacker to gain unauthorized access to sensitive information,
enumerate database structure or modify database records on the targeted system.

Affected products

Product	Affected versions	Fixed in
Radius Synergies Radius Xenia M2M Platform	= Version	No fix listed

References

www.cert-in.org.in third-party-advisory

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: None
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (2)

v4.0 9.3 · cert-in
v4.0 9.3 · vdisclose@cert-in.org.in

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.50% (percentile 43.5)
CWE: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.