Vulnerability · Published Mar 2, 2026 · Assigned by INCIBE
CVE-2026-2584SQL Injection in Ciser System SL firmware
Critical 9.3
In plain English
A critical-severity SQL injection in CSIP firmware from Ciser System SL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system. An unauthenticated, remote attacker (AV:N/PR:N) can exploit this flaw by sending specially crafted SQL queries through the login interface. Due to low attack complexity (AC:L) and the absence of specific requirements (AT:N), the vulnerability allows for a total compromise of the system's configuration data (VC:H/VI:H). While the availability of the service remains unaffected (VA:N), the breach may lead to a limited exposure of sensitive information regarding subsequent or interconnected systems (SC:L).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ciser System SL | CSIP firmware | 3.0 to 5.1 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:N/SA:N