MobilMen 20T CVE-2026-2397

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions - remote unauthenticated exploitation over the network against MobilMen 20T versions v3 through 10072026, requiring no authentication and no user interaction. Exploitation is limited primarily by reachability: the attacker must have network access to the vulnerable application endpoint, so deployments confined to an internal LAN or behind a VPN/firewall are materially harder to reach than internet-exposed instances. The exact vulnerable parameter/endpoint is not disclosed in the available data, and the product's limited/regional deployment further constrains realistic targeting.

Signals partly align and partly conflict. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes an unauthenticated, low-complexity, network-reachable attack with total confidentiality, integrity and availability impact - the reason for the 9.8 score. SQL injection is inherently automatable and reliably weaponizable, which supports treating it as high priority where the product is exposed. However, counterbalancing signals lower the practical urgency: there is no EPSS score provided, no KEV listing (no confirmed active exploitation), and no public exploit identified. MobilMen 20T is a niche, regionally-deployed product, so exploitation is likely to be targeted rather than internet-wide mass scanning. Net: genuinely severe for any organization actually running MobilMen 20T with network exposure, but low real-world blast radius given limited deployment footprint. Note the AV:N rating assumes the application is network-reachable; retail/POS backends are frequently on internal LANs, which would reduce exposure - verify actual network placement.

An attacker who can reach the MobilMen 20T application over the network submits a crafted value into a vulnerable parameter (e.g., a login, search, or product-lookup field), breaking out of the intended SQL query to dump the entire database - pricing, transaction and customer data - or to modify records. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required and the attack is easily scripted; no public proof-of-concept has been identified, so exploitation would require an attacker to develop the injection independently.