A SQL injection flaw exists in the ZTE ElasticNet RNIA R18 NGI product, enabling an attacker who is authenticated to submit crafted input that is passed directly to the database. This allows the attacker to read, modify or delete data stored in the system, potentially exposing confidential information. The stated threat level is internal, meaning the vulnerability is exploitable by users who already have system login capability.

The affected product is ZTE’s ElasticNet RNIA R18 NGI. No specific version range is listed in the advisory, so all instances of this product should be examined for the flaw.

The CVSS score of 6.5 indicates a moderate risk, with baseline exploitation likely requiring authenticated access. The EPSS score is not available, so available data does not indicate a high probability of exploitation in the near term. The vulnerability is not included in the CISA KEV catalog. Attackers would need to be logged into the system and supply malicious input to execute the injection; no remote unauthenticated vector is reported in the description.