The flaw resides in the Page_Load routine of TireMng.aspx within the Hisense TransTech Smart Bus Management System. An attacker can manipulate the 'key' argument to inject arbitrary SQL statements, thereby gaining unauthorized access to, or alteration of, the underlying database. The vulnerability enables remote exploitation, as confirmed by published proofs of concept, and carries the potential to compromise data confidentiality and integrity across the bus management platform.

Hisense TransTech Smart Bus Management System versions up to and including 20260113 are affected. The vulnerability is present in the TireMng.aspx component under the YZSoft/Forms/XForm/BM/BusComManagement directory. No later versions were listed, so the stated release date marks the highest known vulnerable build.

The CVSS score of 6.9 reflects a high severity rating for this SQL injection. EPSS is reported to be below 1%, indicating a very low but non-zero probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog, suggesting it has not yet been linked to known large-scale attacks. The attack vector is remote; an adversary only needs to influence the 'key' parameter sent to the web server. The existence of a publicly disclosed exploit demonstrates that the flaw can be leveraged with minimal technical skill.