The Radius Xenia M2M Platform contains a SQL injection flaw in the password recovery feature of its web management interface. An unauthenticated attacker can send crafted input that is directly executed by the database, allowing them to read, pretend, or alter persistent data. This fault permits unauthorized disclosure, tampering or potentially deletion of sensitive information stored in the system.

All versions of the Radius Xenia M2M Platform from Radius Synergies are potentially affected. The vendor advisory does not provide a specific version range, so any deployed instance could be vulnerable until a patch is applied.

With a CVSS score of 9.3, the vulnerability is classified as critical. No EPSS score is available, but the flaw can be exploited from the public internet if the web management interface is reachable, and the attacker does not need any authentication. The vulnerability is not yet listed in the CISA KEV catalog, yet the exploit path—an unauthenticated remote attacker supplying SQL through the password recovery form—remains highly feasible for any exposed instance of the platform.