CVE-2026-9668 — SQL injection vulnerability in ZTE SCP product

CVE-2026-9668

SQL injection vulnerability in ZTE SCP product PUBLISHED

Description (CNA)

With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitation threshold, wide scope of impact, requires no external privilege escalation, and is classified as a high-priority fix.

Affected (CNA)

Vendor / product	Versions
ZTE / SCP	affected ZENIC-ONE-R20-SCP-V16.25.20.071

CWE

CWE-89

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/7440762086373310571

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.