Radius Xenia M2M Platform: SQL injection in password recovery
Summary
The web management interface of the Radius Xenia M2M Platform does not sufficiently validate user input in the password recovery functionality. An unauthenticated remote attacker can send crafted SQL queries through input fields. Successful exploitation could allow access to sensitive information, enumeration of the database structure, or modification of database records.
Affected
- Radius Synergies Radius Xenia M2M Platform, affected versions unknown
- Conflicting data on default status: CERT-In record lists the product as unaffected by default, ThreatInt lists it as unaffected by default with a custom affected version
Fixed in
- Unknown. No fixed version has been identified.
Workaround
- No vendor-published workaround found.
- Generic mitigation from VulDB: fix input validation in the password recovery module and add server-side sanitisation (not a vendor fix).
Exploitation
- Exploited in the wild: not known.
- Public exploit: none known according to VulDB.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- Attack requires no authentication, only network access to the web management interface.
Our recommendation
- Check whether any Radius Xenia instance has a web management interface reachable from the internet or by third parties; treat as high priority until affected versions are confirmed.
- Restrict access to the management interface to trusted networks or a VPN.
- Ask Radius Synergies for an advisory, affected versions and patch status.
- Review the CERT-In advisory CIVN-2026-0529 and monitor NVD and CISA KEV for updates.
- Monitor web and database logs for unusual input in the password recovery form.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT-In advisory CIVN-2026-0529 www.cert-in.org.in
- VulDB CVE-2026-114358 vuldb.com
- VulDB vulnerability 428327 vuldb.com
- OffSeq Radar CVE-2026-114358 radar.offseq.com
- Strix CVE-2026-114358 www.strix.ai
- ThreatInt CVE-2026-114358 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:31.
Original description (NVD)
This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted SQL query through input fields to the targeted system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to sensitive information, enumerate database structure or modify database records on the targeted system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.