ZTE Elasticnet RNIA EUVD-2026-115113

Exploitation requires an authenticated session to the Elasticnet RNIA R18 NGI application (CVSS PR:L; the description states the attack occurs 'while logged in'), which limits the attack to users who already possess valid credentials or have otherwise gained access - consistent with the vendor's 'internal threat level' classification. No user interaction is required (UI:N) and the interface is network-reachable (AV:N), but the authentication prerequisite is the primary limiting factor. The specific vulnerable feature, endpoint, or parameter is not described in the available sources. Impact is limited to disclosure of database information; no integrity or availability impact is indicated.

This is a moderate-severity, authenticated SQL injection (CWE-89) in ZTE Elasticnet RNIA R18 NGI. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) describes network-reachable, low-complexity exploitation that requires some level of prior authentication (PR:L) and yields high confidentiality impact only (C:H) with no integrity or availability effect - consistent with the description's 'steal database information while logged in'. The vendor labels this an internal threat level, reinforcing that an authenticated/internal actor is the assumed adversary rather than an anonymous remote one. No EPSS score is provided, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present, so there is no confirmed signal of active or likely exploitation. The vuln.today decision label is 'this_month', indicating a routine patch cadence rather than emergency action. Net assessment: a real but bounded issue - the authentication prerequisite and confidentiality-only impact keep it below a drop-everything priority, while the network vector and low attack complexity make it worth remediating within a normal cycle, especially where the management interface is broadly accessible to internal users.

An attacker who already holds valid (potentially low-privileged) credentials to the Elasticnet RNIA R18 NGI web interface submits crafted input into a vulnerable parameter, injecting SQL that the backend executes. This lets them read database contents beyond their authorization - for example configuration, credentials, or subscriber/operational data. No public exploit code has been identified, and the low attack complexity (AC:L) means exploitation is straightforward once authenticated access is obtained.