This vulnerability (CVE-2024-6699) involves improper neutralization of special elements used in SQL commands (CWE-89) in Mikafon MA7 firmware versions 3.0 up to but not including 3.1. It allows an attacker to perform SQL Injection attacks, which can lead to unauthorized access or modification of the underlying database. The CVSS 4.0 base score is 9.3, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity. No vendor advisory or patch information is available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the Mikafon MA7 device's database. This can lead to unauthorized data disclosure, data modification, or other impacts depending on the database usage. The critical CVSS score reflects the potential for severe impact on confidentiality and integrity of data managed by the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected Mikafon MA7 devices to trusted sources only and monitor for unusual activity. Avoid exposing the device directly to untrusted networks. Follow up with Mikafon Electronic Inc. for updates on patches or mitigations.