CVE-2026-33614
Unauthenticated SQL Injection in getinfo Endpoint Causes Data Leak
Publication date: 2026-04-02
Last updated on: 2026-04-16
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mbconnectline | mbconnect24 | to 2.19.4 (inc) |
| mbconnectline | mymbconnect24 | to 2.19.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33614 is an unauthenticated SQL Injection vulnerability affecting the MB connect line products mbCONNECT24 and mymbCONNECT24.
It occurs in the "getinfo" endpoint due to improper neutralization of special elements in a SQL SELECT command.
This flaw allows a remote attacker to execute arbitrary SQL queries without authentication.
As a result, the attacker can gain unauthorized read access to the complete database, causing a total loss of confidentiality.
How can this vulnerability impact me? :
This vulnerability can lead to a total loss of confidentiality by allowing an unauthenticated remote attacker to read the entire database.
Because the attacker can execute arbitrary SQL queries without any privileges or user interaction, sensitive information stored in the database can be exposed.
The impact is high on confidentiality but does not affect data integrity or availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users should update their mbCONNECT24 and mymbCONNECT24 devices to firmware version 2.19.5 or later.
This update fixes the unauthenticated SQL Injection vulnerability in the getinfo endpoint and prevents unauthorized read access to the database.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability results in a total loss of confidentiality by allowing unauthorized read access to the complete database through an unauthenticated SQL Injection attack.
Such a loss of confidentiality can lead to non-compliance with common standards and regulations like GDPR and HIPAA, which require the protection of sensitive personal and health information against unauthorized access.
Therefore, if exploited, this vulnerability could cause violations of data protection requirements mandated by these regulations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects the "getinfo" endpoint of mbCONNECT24 and mymbCONNECT24 devices up to firmware version 2.19.4. Detection involves checking for the presence of this vulnerable endpoint and testing for SQL Injection by sending crafted requests that include SQL special characters or payloads to observe if unauthorized data is returned.
A common approach is to use tools like curl or specialized vulnerability scanners to send requests to the getinfo endpoint with SQL injection payloads such as single quotes (') or SQL keywords to see if the system responds with database errors or unexpected data.
- Example curl command to test for SQL Injection on the getinfo endpoint: curl -v "http://<target-ip>/getinfo?param=' OR '1'='1"
- Use automated scanners like sqlmap targeting the getinfo endpoint URL to detect SQL Injection vulnerabilities.
Additionally, verifying the firmware version of the device is important, as versions 2.19.5 and later have the fix applied. Devices running versions up to 2.19.4 are vulnerable.