---
id: "CVE-2026-114358"
kind: "vulnerability"
aliases: ["CVE-2026-114358"]
title: "Radius Xenia M2M Platform: SQL injection in password recovery exposes database"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "m2m", "radius-xenia", "sql-injection", "unauthenticated", "web-management"]
not_affected_if: ["unknown"]
published_at: "2026-10-29T09:17:07+00:00"
first_seen_at: "2026-10-29T09:23:58+00:00"
updated_at: "2026-10-29T09:25:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114358", "first_seen_at": "2026-10-29T09:23:58+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T09:25:23+00:00"}]
---

# Radius Xenia M2M Platform: SQL injection in password recovery exposes database

The Radius Xenia M2M Platform does not validate input in its web management password recovery function. An unauthenticated remote attacker can send crafted SQL through input fields to read sensitive data, enumerate the database structure, or modify records.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-29T09:23:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114358
- 2026-10-29T09:25:23+00:00 analyst — No vendor/maintainer advisory found (searched web for Radius Xenia/myxenius and CISA ICS; NVD page returns no version or fix data). Versions, fix, and exploitation status unknown; vendor portal res.myxenius.com has a forgot_password page but no advisory. Settle by vendor contact or a CISA/CERT advisory.

## From the sources

This
vulnerability exists in the Radius
Xenia M2M Platform due to insufficient validation of user supplied input in
the password recovery functionality in the web management interface. An
unauthenticated remote attacker could exploit this vulnerability by supplying
crafted SQL query through input fields to the targeted system. 



Successful exploitation of this vulnerability
could allow the attacker to gain unauthorized access to sensitive information,
enumerate database structure or modify database records on the targeted system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_