CVE-2026-9668: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in ZTE SCP

This vulnerability (CVE-2026-9668) in ZTE SCP involves improper neutralization of special elements used in SQL commands (CWE-89). Attackers who possess legitimate user credentials can exploit this flaw to inject malicious SQL statements, bypass authentication mechanisms, and execute arbitrary queries on the database. The exploitation can lead to degraded database performance and broader query capabilities. The vulnerability is notable for its low exploitation complexity and broad impact scope. No official remediation or patch information is currently available.

Successful exploitation allows attackers with valid credentials to bypass authentication logic and execute arbitrary database queries, potentially impacting database performance and security. The vulnerability does not require privilege escalation or user interaction, increasing its risk. The confidentiality impact is high, while integrity impact is not indicated, and availability impact is low due to slow queries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to legitimate user credentials and monitor for unusual database query patterns related to authentication bypass attempts.