Radius Xenia M2M SQL Injection CVE-2026-114358: What Administrators Should Know

Introduction

Short answer:** CERT-In’s CIVN-2026-0529 describes a HIGH-severity SQL-injection vulnerability in the password-recovery functionality of the Radius Xenia M2M Platform. It says an unauthenticated remote attacker could access sensitive information or enumerate and modify database records. Administrators should identify affected deployments, contact Radius for the patched version and review logs without testing live systems with attack strings.

**Key takeaways**

- The issue is tracked as CVE-2026-114358.

- CERT-In says the vulnerable workflow is password recovery in the web management interface.

- Potential impact includes information disclosure and database-record modification.

- The advisory directs users to contact Radius Synergies for a patched version.

- Do not run exploit attempts against production or internet-facing systems.

What is the Radius Xenia M2M Platform?

Radius describes its Xenia ecosystem as a smart platform used with connected services, including smart prepaid metering, energy management and building-management solutions. That context makes the issue important for organizations that connect web management systems to operational or utility data.

The CERT-In note specifically describes a password-recovery input-validation problem. An unauthenticated attacker could submit crafted input to the affected workflow. The advisory does not state that every deployment is reachable from the public internet, so asset owners should verify their own exposure rather than assume compromise.

What could an attacker do?

CERT-In says successful exploitation could allow access to sensitive information, database enumeration or modification of database records. In an M2M or utility context, the consequences may include exposure of management data, altered records or disruption of administrative workflows. The public advisory does not provide evidence of a specific breach campaign.

Security teams should treat the database and management plane as sensitive. Separate application and operational networks where practical, restrict administrative access, and avoid exposing management interfaces directly to the internet unless there is a documented business need and strong access control.

What should administrators do now?

Contact Radius Synergies through a trusted vendor channel and request the patched version or official remediation guidance. Record the deployed product version, internet exposure, password-recovery endpoint, connected data stores and administrative accounts. Do not install an unverified patch from a third-party download page.

Review web-server, application and database logs for unusual password-recovery requests, malformed parameters, unexpected account activity and database changes. Preserve evidence before rotating or deleting logs. If suspicious activity is found, isolate the affected management interface according to the incident-response plan and involve qualified responders.

How can organizations reduce M2M platform risk?

Use network segmentation, allow-listed administrative access, strong unique credentials, phishing-resistant multifactor authentication where supported, least-privilege database accounts and tested backups. Validate that password-recovery workflows do not expose detailed errors or allow untrusted input to reach database queries.

For Indian organizations, include smart-metering, building-management and energy-monitoring vendors in the software and connected-asset inventory. A product may be operated by a facilities or operations team rather than the central IT team, so ownership and patch responsibility should be written down.

FAQs

### Is CVE-2026-114358 confirmed as a data breach?

No. CERT-In describes a vulnerability and possible impacts. It does not confirm a particular organization’s compromise.

### Is a public exploit available?

The CERT-In note describes the issue but does not authorize or require public exploit testing. Do not probe systems you do not own or administer.

### What is the fix?

CERT-In directs users to contact Radius Synergies for the patched version. Confirm the fix and affected-version details with the vendor before deployment.

Conclusion

CVE-2026-114358 is a reminder that connected-device management platforms need the same patching, segmentation and logging discipline as traditional web applications. Identify Radius Xenia deployments, obtain the vendor fix, review the password-recovery and database activity, and keep production systems out of exploit testing.

Limitations

• Reporting channels, procedures and security guidance can change; verify current instructions before acting.

Evidence sources

1. cert-in.org.in — CERT-In CIVN-2026-0529
2. radius.co.in — Radius Synergies
3. cve.org — CVE-2026-114358 Record
4. cert-in.org.in — CERT-In Vulnerability Notes