External risk intelligence

Radius Xenia M2M Platform SQL Injection via Password Recovery.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-114358

The vulnerability exists in the web management interface of the Radius Xenia M2M Platform. M2M (Machine-to-Machine) platforms and their management interfaces are frequently deployed as internet-facing services or gateways to facilitate remote management and connectivity, making them commonly reachable from the internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in the Radius Xenia M2M Platform's web interface could allow unauthorized attackers to gain access to sensitive information, alter database records, or view database structures. The core issue stems from how the platform handles user-supplied input during the password recovery process, which an attacker could manipulate with a crafted SQL query to compromise the system.

Flaw in password recovery allows data access.
Matters for protecting sensitive platform data.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target the Radius Xenia M2M Platform's web management interface, specifically its password recovery feature, to access sensitive information. This vulnerability arises from the platform's failure to properly validate user-supplied input, allowing an attacker to inject malicious SQL queries. Successful exploitation could lead to unauthorized data access, database structure enumeration, or modification of database records.

Unauthenticated remote access required.
Crafted SQL query submitted to input fields.
Sensitive data access and database modification.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could exploit insufficient input validation in the password recovery function of the Radius Xenia M2M Platform's web management interface. By submitting a specially crafted SQL query, an attacker could potentially gain unauthorized access to sensitive information, discover the database structure, or alter existing database records.

Database information and records
Via crafted SQL injection
Unauthorized data access

Operational Fix

Recommended remediation, mitigation, and detection steps

The Radius Xenia M2M Platform's web management interface is affected, suggesting that platform or infrastructure teams managing the M2M service and their associated web infrastructure are likely responsible for addressing this vulnerability. The first practical step involves identifying all instances of the platform, assessing their internet reachability and business criticality, and then locating the accountable system owner to plan remediation based on the determined risk.

Platform owners should address this.
Verify internet reachability and criticality first.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Radius Xenia M2M Platform?

The Radius Xenia M2M Platform is a machine-to-machine solution designed to facilitate connectivity and remote management between devices. Its web management interface acts as a central control point for administrators to oversee these connected systems, monitor data flows, and perform routine configuration tasks, such as managing user credentials.

What does SQL injection mean for CVE-2026-114358?

This vulnerability is classified as CWE-89, or improper neutralization of special elements used in an SQL command. In this context, it means the platform's password recovery feature does not properly check user input. Consequently, an attacker can input database commands instead of expected text, tricking the system into executing those commands to leak, view, or change underlying database information.

How does an attacker trigger this vulnerability?

An unauthenticated remote attacker triggers this by interacting with the password recovery fields on the platform's web interface. By submitting a crafted SQL query rather than valid recovery information, they bypass typical input restrictions. Note that this flaw is specific to the password recovery workflow; it is not triggered by standard, non-malicious use of the login or configuration pages.

Is my instance of Radius Xenia M2M at risk?

Halo Surface Signal indicates that because this platform is often deployed as an internet-facing service or gateway to maintain M2M connectivity, your instance may be reachable from the public internet. If your web management interface is exposed to the internet, it is at higher risk of unauthorized access via this flaw compared to systems strictly isolated within an internal network.

What steps should I take to respond to CVE-2026-114358?

First, inventory all instances of the Radius Xenia M2M Platform across your environment. Assess each instance to determine if it is internet-facing or handles critical business data. Once you identify the systems and their respective owners, prioritize those with external reachability for risk assessment and coordinate with your technical teams to plan for the necessary security updates.

References

www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.