CVE-2026-4978 is a critical (CVSS 9.8) SQL injection in the UMAI Vision Traffic Analysis System. The record says it affects versions from 30 before 34. Update to version 34 or later, and read the national CERT notice named in the record for the vendor's remediation steps.
What's affected
- Product: UMAI Vision Traffic Analysis System.
- Affected: from version 30 before version 34, per the record.
- Fixed: version 34, as implied by the range. I could not read the advisory page, so confirm with the notice.
- Weakness: CWE-89, SQL injection.
- CVSS 9.8 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - Published 30 July 2026. Not marked as exploited in CISA KEV.
How to check if you're exposed
Find the version in the product's administration page or in your installation records. Compare it with the range above.
Then check exposure. Is the web interface reachable from the internet or from broad internal networks? Look at firewall rules and at the vendor documentation for ports the system uses. Review web server and database logs for unusual queries or errors that mention SQL syntax.
What to do now
- Update the system to version 34 or later, using the vendor supplied package.
- Read the Turkish National CERT notice TR-26-0703 named in the record for vendor details.
- Restrict network access to the management and data interfaces to the staff and systems that need them.
- Review database and web logs for signs of misuse, and rotate database credentials as a precaution.
- Take a backup before and after the update.
Why it matters
SQL injection lets input change the meaning of a database query. In a traffic analysis system, the database may hold sensor data, vehicle records and operator credentials, so the impact depends on what is stored. The record scores it at the top of the high range for network reach and no login, and the class is CWE-89.
The fix is prepared statements and least privilege for the database account. For buyers of such systems, ask vendors how they test for injection and how fast they ship fixes.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs.
Quick check
Why is the version range written as 30 before 34?
That is how the record states it. Treat versions from 30 up to but not including 34 as affected and plan for 34.
Sources
- Turkish National CERT notice TR-26-0703 (named in the record; it did not render for me, so details come from the record)
- Safeguard Gold entry
Last reviewed: 19 October 2026.
