Xenia M2M Platform EUVD-2026-112677

The required entry point is specific: the password-recovery functionality within the Radius Xenia M2M Platform web management interface, reached over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation needs no authentication, no user interaction, and low complexity - so the practical prerequisite is simply network reachability to the web management interface. The main limiting factor is therefore exposure: instances whose management interface is not reachable from the attacker's network position (e.g., behind segmentation or not internet-facing) are not exploitable by remote attackers. No specific non-default configuration is called out in the advisory as a precondition.

This is a genuinely high-priority issue, not an inflated high-CVSS score. The signals align consistently: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, and the vuln.today decision label is act_now, reflecting the ease of exploitation of a classic SQL injection (CWE-89) in an internet-facing password-recovery endpoint. The impact metrics (VC:H/VI:H, VA:N) match the description: confidentiality and integrity are heavily affected (read and modify database records) while availability is not directly impacted. That said, several decision signals are MISSING rather than conflicting: no EPSS probability is provided, there is no CISA KEV listing (CERT-In, not CISA, is the reporting body, and KEV tracks U.S. federal exploitation cases), and no SSVC exploitation/automatable sub-values are supplied beyond the act_now label. No public exploit was identified at time of analysis. The absence of EPSS/KEV data should not be read as low risk - it is simply unavailable; an unauthenticated SQLi on a web management interface is characteristically easy to weaponize and discover via automated scanning, which is consistent with the act_now prioritization.

An unauthenticated remote attacker locates the web management interface of a Radius Xenia M2M Platform instance and submits crafted SQL in the password-recovery input fields. Because input is insufficiently validated, the injected query executes against the backend database, letting the attacker enumerate the schema, read sensitive records, or modify data. The low attack complexity and lack of required authentication or user interaction make this straightforward to automate; no public exploit code was identified at time of analysis.