What is CVE-2026-118871?

CVE-2026-118871 is a medium-severity vulnerability in ZTE Elasticnet Rnia R18 Ngi, classified under SQL Injection. CVSS score: 6.5/10. Published 2026-11-02.

How severe is CVE-2026-118871?

Medium severity. CVSS v3 base score is 6.5 out of 10.

SQL Injection in ZTE Elasticnet Rnia R18 Ngi

CVE-2026-118871

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in.

Vulnerability class: SQL Injection

Published 2026-11-02 · last modified 2026-11-02.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

ZTE Elasticnet Rnia R18 Ngi — versions NGIV16.26.11SP04 and earlier versions

Weakness classification (CWE)

CWE-89 — SQL Injection

References

support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031803240

Frequently asked questions

What is CVE-2026-118871?: CVE-2026-118871 is a medium-severity vulnerability in ZTE Elasticnet Rnia R18 Ngi, classified under SQL Injection. CVSS score: 6.5/10. Published 2026-11-02.
How severe is CVE-2026-118871?: Medium severity. CVSS v3 base score is 6.5 out of 10.