This vulnerability (CVE-2026-33613) in mbCONNECT24 is due to improper neutralization of special elements used in OS commands (CWE-78), specifically in the generateSrpArray function. An attacker with the ability to write arbitrary data to the user table can exploit this flaw to execute arbitrary OS commands remotely, potentially resulting in full system compromise. The CVSS 3.1 score is 7.2, indicating high severity with network attack vector, low attack complexity, but requiring high privileges. No patch or official remediation information is provided, and the product is not a cloud service.

If exploited, this vulnerability allows an attacker with existing write access to the user table to execute arbitrary OS commands remotely, leading to full compromise of the affected system. This includes complete confidentiality, integrity, and availability loss. However, exploitation requires a prerequisite capability to write arbitrary data, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict write access to the user table to trusted users only to mitigate exploitation risk.