PT-2026-130671

CVE-2026-114358

Published

2026-10-29

Updated

2026-10-29

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Radius Xenia M2M Platform (affected versions not specified)

Description Insufficient validation of user-supplied input in the password recovery functionality of the web management interface allows an unauthenticated remote attacker to perform SQL injection. By supplying crafted SQL queries through input fields, an attacker can gain unauthorized access to sensitive information, enumerate the database structure, or modify database records.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers

CVE-2026-114358

Found an issue in the description? Have something to add? Feel free to write us 👾

dbugs@ptsecurity.com