MB Connect Line mbCONNECT24 and mymbCONNECT24 SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the DevSerialReset function of MB Connect Line's mbCONNECT24 and mymbCONNECT24 products, all versions through 2.20.0. This vulnerability allows high-privileged remote attackers to exploit improper handling of special elements in a SQL UPDATE command. As a result, attackers can read the entire database and modify values in a non-critical table, leading to a complete loss of confidentiality and some loss of integrity.

Impact

Exploitation of this vulnerability allows for unauthorized SQL injection, enabling attackers to read the entire database and modify values in a non-critical table.

Remediation

Users are advised to update to version 2.20.1 of mbCONNECT24 or mymbCONNECT24.