CVE-2026-9668— SQL injection vulnerability in ZTE SCP product
Quick assessment
Affected
ZTE SCP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在拥有合法用户凭据的情况下，攻击者可以构造恶意的 SQL 语句，绕过身份验证逻辑，直接执行任意的数据库查询。这进而会导致数据库查询变慢以及查询范围扩大。该漏洞的利用门槛低、影响范围广，无需外部权限提升即可利用，因此被归类为高优先级修复项。
Possible ATT&CK Techniques 1 AI
T1110 · Brute Force
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-9668
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SQL injection vulnerability in ZTE SCP product
Source: CVE Program / CVE List V5
Vulnerability Description
With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitation threshold, wide scope of impact, requires no external privilege escalation, and is classified as a high-priority fix.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-9668
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9668
请登录查看更多情报信息。
Other References for CVE-2026-9668 (1)
IV. Related Vulnerabilities
Same vendor: ZTE
-
CVE-2026-49008
Integrity‑check credential leakage vulnerability in an appli -
CVE-2026-49007
Information leakage vulnerability in ZTE F689 product -
CVE-2026-49006
TLS credential leakage vulnerability in ZTE F689 product -
CVE-2026-49005
Root password hash exposure vulnerability in ZTE F689 produc -
CVE-2026-8029
SQL Injection Vulnerability in ZTE SmartLife App
Same weakness: CWE-89
-
CVE-2026-81203
SourceCodester Simple Online Food Ordering System ajax.php l -
CVE-2026-49809
Dell PowerProtect Cyber Recovery 20.2 及之前版本SQL注入 -
CVE-2026-54245
Fleet: SQL injection in Okta conditional access endpoint all -
CVE-2026-46371
Fleet: Observer-level enrollment secret extraction via ORDER -
CVE-2026-46370
Fleet has observer-level enrollment secret extraction via OR
V. Comments for CVE-2026-9668
No comments yet