MB Connect Line mbCONNECT24 and mymbCONNECT24 Unauthenticated SQL Injection Vulnerability

A remote SQL injection vulnerability has been identified in MB connect line's mbCONNECT24 and mymbCONNECT24 products, specifically in firmware versions 2.20.0 and prior. The vulnerability arises from improper handling of special elements in a SQL SELECT command within the getAlarmProfiles function, allowing unauthenticated attackers to manipulate SQL queries. This exploitation could lead to unauthorized access to the database, causing a complete loss of confidentiality.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to interfere with the application's database queries. This could result in unauthorized data access or manipulation.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.20.1.