# CVE-2026-118871: SQL Injection vulnerability in ZTE ElasticNet RNIA R18 NGI product

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- ZTE / ElasticNet RNIA R18 NGI: NGIV16.26.11SP04 and earlier versions (affected). Source: CNA: zte

## Severity and prioritization

- CVSS 3.1: 6.5 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; source: CNA: zte

- CVSS 3.1: 6.5 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; source: NVD: psirt@zte.com.cn

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-89

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031803240 (CNA: zte)

- https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031803240 (psirt@zte.com.cn)

## Provenance

- CNA: zte: https://www.cve.org/CVERecord?id=CVE-2026-118871; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-118871; retrieved 2026-11-02; source updated 2026-11-02

Revision: 04134f8459f924f17987ea74ad316579168ba1b539ce957b5cfa6adf8b01a00d

Canonical: https://y2.dev/cve/CVE-2026-118871