This vulnerability (CVE-2024-6919) in NACPremium involves improper neutralization of special elements used in SQL commands, classified as CWE-89 (SQL Injection). It enables Blind SQL Injection attacks, allowing an unauthenticated attacker to remotely exploit the system with high impact on confidentiality and integrity. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. The vulnerability affects NACPremium versions up to 01082024, but no specific affected versions are listed. No patch or remediation level has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability could allow an attacker to extract sensitive information from the backend database or manipulate database queries, impacting confidentiality and integrity of data. The CVSS score of 9.3 reflects critical severity with potential for significant unauthorized data access or modification. There are no reports of active exploitation in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation has been provided by NAC Telecommunication Systems Inc., users should monitor vendor communications closely. Until a patch is available, consider applying application-level input validation or web application firewall (WAF) rules to detect and block SQL injection attempts specific to NACPremium. Avoid exposing vulnerable interfaces to untrusted networks if possible.