Read the docs
TI-2026-07916 Aliases CVE-2026-9003GHSA-vp9q-mvq5-jq9m

TONNET｜E-LAN Hybrid Recording System - SQL Injection

Priority MEDIUM 44CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

E-LAN Hybrid Recording System developed by TONNET has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00539 45th percentileScored 2026-11-07
Fix Fixed TPR7308 (TONNET): mdiskTRS08_tonnet_20260203-1636

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TONNETTPR7308before mdiskTRS08_tonnet_20260203-1636mdiskTRS08_tonnet_20260203-1636Patch availableCNA
  • TPR7308 VendorTONNET Affected before mdiskTRS08_tonnet_20260203-1636 Fixed in mdiskTRS08_tonnet_20260203-1636 Patch available CNA

Remediation

  • Fix · CNA TPR7308 (TONNET) Fixed in mdiskTRS08_tonnet_20260203-1636

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9003
  2. 2026-10-03 Alias added: GHSA-vp9q-mvq5-jq9m

References

Advisory 2

  • TI-2020-03424 TONNET DVR – Firmware Injection CVSS 3.1CRITICAL 9.8
  • TI-2020-03423 TONNET DVR – Broken Access Control CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences