SQL Injection in ZTE Scp

CVE-2026-9668

With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitation threshold, wide scope of impact, requires no external privilege escalation, and is classified as a high-priority fix.

Vulnerability class: SQL Injection

EPSS: 0.006 (45.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L.

Affected products

  • Zte Scp — versions ZENIC-ONE-R20-SCP-V16.25.20.071

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-9668?
CVE-2026-9668 is a medium-severity vulnerability in ZTE Scp, classified under SQL Injection. CVSS score: 6.3/10. Published 2026-08-26.
How severe is CVE-2026-9668?
Medium severity. CVSS v3 base score is 6.3 out of 10.