The vulnerability is a classic SQL injection caused by improper neutralization of special elements used in a SQL command. It allows an attacker to inject arbitrary SQL statements, potentially reading sensitive data, modifying records, or disrupting the database. This flaw falls under CWE-89 and can compromise the confidentiality, integrity, and availability of the Traffic Analysis System.

The affected product is UMAI Vision Traffic Analysis System. Versions from 30 up to, but not including, 34 are vulnerable. No specific subversion information is provided beyond these major releases.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of 0.0026 indicates a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. However, the attack vector is inferred to be remote, requiring the ability to send crafted input to the vulnerable interface. An attacker with access to such input could leverage the flaw to execute arbitrary SQL commands if no additional protections are in place.