{"id":"CVE-2026-114358","aliases":[],"cve":{"records":[{"id":"CVE-2026-114358","source":"CERT-In","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-21T08:42:31.156Z","published":"2026-10-29T08:53:05.549Z","modified":"2026-10-29T14:13:51.533Z"}],"publishers":[{"name":"CERT-In","role":"CNA","organizationId":"66834db9-ab24-42b4-be80-296b2e40335c","modified":"2026-10-29T08:53:05.549Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T14:13:51.533Z"}],"references":[{"url":"https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0529","tags":["third-party-advisory"],"source":"CERT-In"}],"weaknesses":[{"id":"CWE-89","description":"CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')","source":"CERT-In"}],"applicability":[{"source":"CERT-In","statements":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:radius_synergies:radius_xenia_m2m_platform:version:*:*:*:*:*:*:*"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T14:13:39.146085Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"SQL Injection Vulnerability in Radius Xenia M2M Platform","titleSource":"CERT-In","descriptionSource":"CERT-In","description":"This\nvulnerability exists in the Radius\nXenia M2M Platform due to insufficient validation of user supplied input in\nthe password recovery functionality in the web management interface. An\nunauthenticated remote attacker could exploit this vulnerability by supplying\ncrafted SQL query through input fields to the targeted system. \n\n\n\nSuccessful exploitation of this vulnerability\ncould allow the attacker to gain unauthorized access to sensitive information,\nenumerate database structure or modify database records on the targeted system.","score":9.3,"severity":"critical","published":"2026-10-29T08:53:05.549Z","modified":"2026-10-29T14:13:51.533Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Radius Synergies","name":"Radius Xenia M2M Platform","platforms":[],"versions":[{"version":"Version","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"CERT-In","url":"https://www.cve.org/CVERecord?id=CVE-2026-114358"}],"remediation":[{"text":"Contact\nvendor for the patched version.","source":"CERT-In","url":"https://www.cve.org/CVERecord?id=CVE-2026-114358"}],"references":["https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0529"],"sources":[{"name":"CVE","id":"CVE-2026-114358","modified":"2026-10-29T14:13:51.533Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-114358"}],"assessments":[{"source":"CERT-In","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":9.3}],"sourceAffected":[],"observedAt":"2026-10-29T14:28:02.729Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T15:15:33.047Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-29T09:10:31.959Z","attemptedAt":"2026-10-29T09:10:31.959Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T09:10:31.495Z","attemptedAt":"2026-10-29T09:10:31.495Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-29T09:10:31.495Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T09:10:31.957Z","attemptedAt":"2026-10-29T09:10:31.957Z"}],"evidence":[],"aiSummary":null}