This vulnerability (CVE-2024-7076) in Semtek Sempos arises from improper neutralization of special elements used in SQL commands, classified under CWE-89 (SQL Injection). It enables an unauthenticated attacker to perform Blind SQL Injection attacks, potentially leading to unauthorized data access or manipulation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with high impact on confidentiality and integrity, and low impact on availability. The vulnerability affects versions of Semtek Sempos up to 31 July 2024. No patch or remediation level has been published by the vendor, and no known exploits have been reported.

An attacker can exploit this vulnerability remotely without authentication or user interaction to perform Blind SQL Injection attacks. This can lead to unauthorized disclosure and modification of sensitive data within the affected Semtek Sempos system. The vulnerability is rated critical with a CVSS score of 9.3, reflecting significant risk to confidentiality and integrity of data. Availability impact is low, and there is no indication of privilege escalation or user access required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any recommended workarounds from the vendor or restrict network access to the affected Semtek Sempos system to trusted users only. Monitor vendor communications closely for updates on patches or mitigations.