CVE-2026-2821
Published: 20 February 2026
Summary
CVE-2026-2821 is a medium-severity Injection (CWE-74) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 2.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-2821 is a SQL injection vulnerability affecting the Fujian Smart Integrated Management Platform System up to version 7.5. The flaw resides in an unknown function within the file /Module/CRXT/Controller/XCamera.ashx, where manipulation of the ChannelName argument triggers the injection. It is classified under CWE-74 and CWE-89.
Remote exploitation is possible with no authentication required, low attack complexity, and no user interaction needed, as indicated by the CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Unauthenticated attackers on the network can leverage this to achieve low-level impacts on confidentiality, integrity, and availability, such as limited data exposure, modification, or denial of service.
References point to a proof-of-concept exploit script (poc.py) and introduction on GitHub, along with VulDB entries documenting the issue. The exploit has been publicly disclosed and could be used in attacks, but no vendor advisories or patches are specified in the available information. The CVE was published on 2026-02-20.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7621
Vulnerability details
A weakness has been identified in Fujian Smart Integrated Management Platform System up to 7.5. Impacted is an unknown function of the file /Module/CRXT/Controller/XCamera.ashx. This manipulation of the argument ChannelName causes sql injection. Remote exploitation of the attack is possible.…
more
The exploit has been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote SQL injection in a public-facing web handler (/Module/CRXT/Controller/XCamera.ashx) directly enables T1190 exploitation with no auth or user interaction required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted inputs such as the ChannelName parameter to block SQL injection payloads before they reach the database.
Boundary protection devices (e.g., WAF rules) can inspect and drop HTTP requests containing SQL metacharacters targeting /Module/CRXT/Controller/XCamera.ashx.
Continuous monitoring of web-application traffic and database queries can identify anomalous SQL syntax originating from unauthenticated remote sources.