Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-10302 | Publication Date: 30 October 2026

Critical SQL Injection Vulnerability in Radius Xenia M2M Platform
CVE-2026-114358

Summary

A critical SQL Injection vulnerability has been identified in the Radius Xenia M2M Platform developed by Radius Synergies. The vulnerability, tracked as CVE-2026-114358, has been assigned a CVSS v4.0 score of 9.3 (Critical).

An unauthenticated remote attacker can exploit this flaw through the password recovery functionality in the web management interface by supplying crafted SQL queries. Successful exploitation may allow the attacker to access sensitive information, enumerate the database structure, or modify database records.

Technical Overview

The vulnerability exists due to insufficient validation of user-supplied input in the password recovery feature of the platform’s web management interface. Because the input is not properly sanitized before being used in SQL queries, an attacker can inject malicious SQL statements.

This is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The attack requires no authentication and can be performed remotely over the network.

Affected Systems

  • Radius Xenia M2M Platform (all currently known versions appear affected)
  • No fixed version has been officially published by the vendor as of 30 October 2026

Recommendations

  1. Immediate Action: Restrict access to the web management interface of the Radius Xenia M2M Platform. Preferably limit it to internal networks or VPN only.
  2. Monitor logs related to the password recovery functionality for any suspicious or unusual activity.
  3. Contact the vendor (Radius Synergies) and request an official security update or patch as soon as it becomes available.
  4. If possible, temporarily disable the password recovery feature until a fix is released.
  5. Apply the principle of least privilege to database accounts used by the application.

Organizations using this platform should treat this vulnerability as high priority due to its unauthenticated remote nature and critical severity.

Support from KSRC

KSRC (Karen IT Security Response Center) is fully prepared to assist organizations with any questions, technical guidance, or incident-related issues arising from this vulnerability.

Whether you require help with impact assessment, mitigation planning, or response coordination, our team is available.

Karen IT
We make the Internet harder to abuse.