Mb Connect Line Mbconnect24 CVE-2026-32969

No special conditions — remote unauthenticated exploitation against default configurations. Attacker sends crafted SQL injection payloads to the userinfo endpoint's authentication method without requiring credentials, victim interaction, or special feature enablement.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates maximum exploitability with network-based attacks requiring low complexity and no privileges or user interaction, though impact is limited to confidentiality. The vulnerability is automatable and could be exploited at scale once details are public. While the 7.5 CVSS score is high, the current risk is moderated by the lack of public exploit code and absence from CISA KEV, suggesting no widespread active exploitation yet. However, the industrial control system context significantly elevates real-world risk because these platforms often provide gateway access to operational technology networks, and extracted credentials could enable lateral movement to critical industrial assets. The blind SQL injection nature may slow exploitation but does not prevent determined attackers from extracting complete databases through time-based or boolean-based techniques. Given the pre-authentication attack surface and the high-value targets (industrial remote access systems), this should be considered a high-priority patch target despite the absence of current exploitation indicators.

An unauthenticated attacker on the internet identifies an exposed mbCONNECT24 portal and crafts malicious SQL payloads in requests to the userinfo endpoint's authentication method, using time-based blind SQL injection techniques to infer database structure and content byte-by-byte. Over several hours of automated queries, the attacker extracts the complete user database including hashed passwords, API keys, and configuration details for connected industrial devices. With this information, the attacker gains legitimate access credentials to industrial control systems managed through the platform, potentially affecting manufacturing operations or critical infrastructure.