MB Connect Line mbCONNECT24 and mymbCONNECT24 Unauthenticated SQL Injection Vulnerability

A low-privileged remote attacker can exploit an unauthenticated SQL injection vulnerability in the devices_configuration view of MB Connect Line mbCONNECT24 and mymbCONNECT24. This vulnerability arises from improper handling of special elements in a SQL SELECT command, potentially leading to a complete loss of confidentiality by allowing unauthorized access to the database.

Impact

Exploitation of this vulnerability allows for SQL injection, with the potential for unauthorized access to the database, according to the vendor.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.20.1.