Critical 9.3Published Oct 29, 2026

CVE-2026-114358SQL Injection Vulnerability in Radius Xenia M2M Platform

Updated under an hour ago (Oct 29, 2026, 2:10 PM ET)

Does this affect you?

It affects Radius Synergies Radius Xenia M2M Platform. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for Radius Synergies Radius Xenia M2M Platform Exploited in the last 30 days

This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted SQL query through input fields to the targeted system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to sensitive information, enumerate database structure or modify database records on the targeted system.

CVSS: 9.3 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-89
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: CERT-In
NVD analysis: Deferred
Record last updated: Oct 29, 2026
First seen by InfoSec Signals: Oct 29, 2026

Affected products

Affected products

Radius Synergies Radius Xenia M2M Platform radius_synergies:radius_xenia_m2m_platform (from the name)	Version	CNA record

References

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0529	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.