This vulnerability (CVE-2026-33614) affects MB connect line's mbCONNECT24 product and involves improper neutralization of special elements in an SQL command within the getinfo endpoint. An unauthenticated remote attacker can exploit this SQL Injection flaw to access confidential data without authorization. The vulnerability is identified as CWE-89 and has a CVSS 3.1 base score of 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or vendor advisory is currently provided, and there are no known exploits in the wild.

Successful exploitation of this vulnerability results in a total loss of confidentiality, allowing attackers to access sensitive information from the affected system without authentication. There is no impact on integrity or availability reported. The vulnerability poses a high risk due to ease of exploitation and the critical nature of data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint where possible and monitor for suspicious activity related to SQL Injection attempts. Avoid exposing the getinfo endpoint to untrusted networks. Follow up with MB connect line for updates on patches or official mitigations.