Vulnerability

CERT-In Vulnerability Note CIVN-2026-0529
SQL Injection Vulnerability in Radius Xenia M2M Platform

Original Issue Date:October 27, 2026

Severity Rating: HIGH

Systems Affected

Radius Xenia M2M Platform

Overview

A vulnerability has been reported in Radius Xenia M2M Platform, which could allow an unauthenticated remote attacker to gain unauthorized access to sensitive information, or modify database records on the targeted system.

Target Audience:
End-users/ Administrators of Radius Xenia M2M Platform.

Risk Assessment:
Manipulation of application logic and information disclosure.

Impact Assessment:
Gain sensitive information, enumerate or modify database records.

Description

The Radius Xenia M2M Platform is a web based IoT platform used to manage M2M connectivity and information associated with connected devices and services.

This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted SQL query through input fields to the targeted system.

Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to sensitive information, enumerate database structure or modify database records on the targeted system.

Credit

This vulnerability is reported by Jainil Borisagar.

Solution

Contact vendor for the patched version.

Vendor Information

Radius Synergies
https://radius.co.in/

References

Radius Synergies
https://radius.co.in/

CVE Name
CVE-2026-114358

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India