Mymbconnect24 CVE-2026-33614

No special conditions — remote unauthenticated exploitation against default installations. The getinfo endpoint accepts unauthenticated requests and does not validate SQL input, allowing attackers to inject malicious SQL commands remotely without authentication or user interaction.

This represents a significant real-world risk due to the combination of unauthenticated access (PR:N), network accessibility (AV:N), low complexity (AC:L), and high confidentiality impact (C:H). The CVSS 7.5 score accurately reflects the severity, though the lack of integrity or availability impact moderates it from critical. Without EPSS data, KEV status, or confirmed POC availability in the provided intelligence, we cannot assess active exploitation likelihood. However, SQL injection vulnerabilities are well-understood by attackers, the technical barrier is low, and industrial IoT products like mbCONNECT24 often contain sensitive operational data, credentials, and configuration details. Organizations using these products for remote machine access should prioritize remediation, as the unauthenticated nature means any network-accessible instance is vulnerable. The disclosure by CERT@VDE through their CSAF advisory suggests coordinated disclosure, but the window between public disclosure and widespread exploitation attempts for such straightforward vulnerabilities is typically narrow.

An attacker identifies an internet-exposed mbCONNECT24 instance through industrial IoT search engines like Shodan. Without requiring credentials, they craft malicious SQL payloads targeting the vulnerable getinfo endpoint, injecting UNION-based or boolean-based queries to enumerate database schema. Through iterative queries, the attacker extracts user credentials, industrial device configurations, VPN connection details, and potentially intellectual property stored in the connectivity platform's database. The low complexity and network accessibility mean automated scanning tools can identify and exploit vulnerable instances at scale, enabling mass data exfiltration campaigns against industrial organizations using these products.