Vulnerability · Published Aug 26, 2026 · Assigned by zte
CVE-2026-9668SQL injection vulnerability in ZTE SCP product
Medium 6.3
In plain English
A medium-severity SQL injection in SCP from ZTE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Official description
With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitation threshold, wide scope of impact, requires no external privilege escalation, and is classified as a high-priority fix.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L