SQL Injection Vulnerability in ZTE Web User Interface
CVE-2026-118871

6.5MEDIUM

Key Information:

Vendor

Zte

Status
Elasticnet Rnia R18 Ngi
Vendor
CVE Published:
2 November 2026

What is CVE-2026-118871?

A SQL injection vulnerability has been identified in the ZTE Web User Interface, allowing authorized users to execute arbitrary SQL queries. This could potentially enable attackers to extract sensitive data from the database, raising significant security concerns. Organizations using this interface must take immediate measures to secure their systems and mitigate the risk of data breaches arising from this vulnerability.

Affected Version(s)

ElasticNet RNIA R18 NGI NGIV16.26.11SP04 and earlier versions

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bullet...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Huu Do
.