Mymbconnect24 CVE-2026-33616

Requires network access to the mb24api endpoint without authentication. Remote unauthenticated attacker can exploit blind SQL injection in SQL SELECT commands via the mb24api parameter. No victim interaction needed. Default configurations of affected product versions are vulnerable.

This vulnerability presents significant real-world risk despite no confirmed active exploitation. The CVSS vector indicates maximum exploitability: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). The attack can be fully automated and executed remotely against internet-exposed instances. While impact is limited to confidentiality (C:H, I:N, A:N), the industrial IoT context elevates concern-stolen credentials or configuration data could enable lateral movement into operational technology environments. The blind SQL injection nature means exploitation requires technical skill but well-documented techniques exist. No public exploit identified at time of analysis, which reduces immediate risk but does not eliminate it given the straightforward exploitation path. Organizations using these products for remote industrial equipment access should prioritize remediation, as the combination of unauthenticated network access and complete confidentiality loss creates substantial data breach risk. The CERT@VDE advisory publication increases attacker awareness.

An external attacker scans internet-exposed mbCONNECT24 or mymbCONNECT24 instances and identifies the vulnerable mb24api endpoint through reconnaissance or publicly available documentation. Without requiring authentication, the attacker crafts HTTP requests containing SQL injection payloads in endpoint parameters, systematically extracting database contents through blind SQL injection techniques such as time-based inference or boolean-based logic manipulation. Over multiple requests, the attacker exfiltrates user credentials, authentication tokens, API keys, customer information, connected device configurations, and industrial equipment access details stored in the database. With this information, the attacker can pivot to connected industrial systems, impersonate legitimate users, or sell access credentials on underground markets, potentially enabling broader operational technology compromise or industrial espionage.