{"affected":[{"defaultStatus":"unaffected","product":"ElasticNet RNIA R18 NGI","source":"CNA: zte","vendor":"ZTE","versions":[{"status":"affected","version":"NGIV16.26.11SP04 and earlier versions"}]}],"cveId":"CVE-2026-118871","cwes":["CWE-89"],"description":"SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: zte","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},{"score":6.5,"severity":"medium","source":"NVD: psirt@zte.com.cn","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793614631123,"publishedAt":1793612155196,"references":[{"source":"CNA: zte","tags":[],"url":"https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031803240"},{"source":"psirt@zte.com.cn","tags":[],"url":"https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031803240"}],"remediation":[],"revision":"04134f8459f924f17987ea74ad316579168ba1b539ce957b5cfa6adf8b01a00d","sources":[{"modifiedAt":1793612155196,"name":"CNA: zte","retrievedAt":1793614106894,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118871"},{"modifiedAt":1793614631123,"name":"NVD","retrievedAt":1793621814991,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118871"}],"ssvc":null,"status":"published","title":"SQL Injection vulnerability in ZTE ElasticNet RNIA R18 NGI product","updatedAt":1793621814991}