Detection Guidance

This vulnerability affects the "getinfo" endpoint of mbCONNECT24 and mymbCONNECT24 devices up to firmware version 2.19.4. Detection involves checking for the presence of this vulnerable endpoint and testing for SQL Injection by sending crafted requests that include SQL special characters or payloads to observe if unauthorized data is returned.

A common approach is to use tools like curl or specialized vulnerability scanners to send requests to the getinfo endpoint with SQL injection payloads such as single quotes (') or SQL keywords to see if the system responds with database errors or unexpected data.

• Example curl command to test for SQL Injection on the getinfo endpoint: curl -v "http://<target-ip>/getinfo?param=' OR '1'='1"
• Use automated scanners like sqlmap targeting the getinfo endpoint URL to detect SQL Injection vulnerabilities.

Additionally, verifying the firmware version of the device is important, as versions 2.19.5 and later have the fix applied. Devices running versions up to 2.19.4 are vulnerable.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-33614 is an unauthenticated SQL Injection vulnerability affecting the MB connect line products mbCONNECT24 and mymbCONNECT24.

It occurs in the "getinfo" endpoint due to improper neutralization of special elements in a SQL SELECT command.

This flaw allows a remote attacker to execute arbitrary SQL queries without authentication.

As a result, the attacker can gain unauthorized read access to the complete database, causing a total loss of confidentiality.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a total loss of confidentiality by allowing an unauthenticated remote attacker to read the entire database.

Because the attacker can execute arbitrary SQL queries without any privileges or user interaction, sensitive information stored in the database can be exposed.

The impact is high on confidentiality but does not affect data integrity or availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, users should update their mbCONNECT24 and mymbCONNECT24 devices to firmware version 2.19.5 or later.

This update fixes the unauthenticated SQL Injection vulnerability in the getinfo endpoint and prevents unauthorized read access to the database.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability results in a total loss of confidentiality by allowing unauthorized read access to the complete database through an unauthenticated SQL Injection attack.

Such a loss of confidentiality can lead to non-compliance with common standards and regulations like GDPR and HIPAA, which require the protection of sensitive personal and health information against unauthorized access.

Therefore, if exploited, this vulnerability could cause violations of data protection requirements mandated by these regulations.

Useful 0 Not Useful 0