This vulnerability involves an SQL injection in ESAFENET CDG software versions up to 20260615. The injection point is related to the 'keyid' parameter in a function located in the file /CDGServer3/ukey/usbkey;logindojojs. An attacker can remotely manipulate this parameter to execute arbitrary SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official fix or patch has been provided by the vendor, and the exploit code is publicly available. The vendor was contacted but did not respond to the disclosure.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform SQL injection attacks against the ESAFENET CDG system. This may lead to unauthorized data access or modification with limited confidentiality, integrity, and availability impact as indicated by the CVSS vector. However, the exact impact depends on the database and application context. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing application-level input validation or web application firewalls to mitigate SQL injection risks until an official patch is released.