The UMAI Vision Traffic Analysis System version 29 contains an SQL injection vulnerability (CWE-89) caused by improper neutralization of special elements used in SQL commands. This flaw enables remote attackers to execute arbitrary SQL commands without authentication, potentially leading to full compromise of the affected system's database confidentiality, integrity, and availability. The vulnerability is publicly documented as CVE-2026-4978 with a CVSS 3.1 base score of 9.8. No vendor advisory or patch information is available, and the product is not a cloud service, so remediation responsibility lies with the end user.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data disclosure, data modification, or deletion, and potentially full system compromise. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any available workarounds or mitigations recommended by the vendor. Restricting network access to the affected system and monitoring for suspicious activity may help reduce risk.