This vulnerability, classified as CWE-425 (Direct Request or Forced Browsing), affects mbCONNECT24 by allowing a remote attacker with high privileges to access a hidden configuration method that is not intended to be accessible. Through this method, the attacker can alter critical program parameters, which can compromise the confidentiality, integrity, and availability of the affected system. The CVSS 4.0 base score is 8.6, indicating a high severity with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

An attacker with high privileges can exploit this vulnerability to modify critical configuration parameters remotely. This can result in a complete compromise of the affected system's confidentiality, integrity, and availability, potentially causing severe operational disruption and data breaches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, it is recommended to monitor vendor communications closely for updates. Restrict access to high-privilege accounts and ensure that only authorized personnel can reach sensitive configuration interfaces until a fix is available.