PT-2026-22571 · Ciser System Sl · Ciser System Sl Firmware

Published 2026-03-02 · Updated 2026-05-19 · CVE-2026-2584

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ciser System SL firmware (affected versions not specified)

Description A critical SQL Injection (SQLi) vulnerability exists within the authentication module. A remote, unauthenticated attacker can exploit this flaw by submitting crafted SQL queries through the login interface. The vulnerability has low attack complexity and does not require specific privileges. Successful exploitation can lead to a complete compromise of the system’s configuration data and limited exposure of sensitive information related to interconnected systems. The vulnerability affects the /login API endpoint, where crafted SQL queries can be submitted. The query parameter is likely involved in the injection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-2584

Affected Products

Ciser System Sl Firmware

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-2584 · Security Note
• https://t.me/CVEtracker/46108 · Telegram Post
• https://t.me/cveNotify/164023 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/sql-injection-ciser-system-sl-firmware · Note