This vulnerability (CVE-2026-33615) affects the mbCONNECT24 product from MB connect line. An unauthenticated attacker can perform SQL Injection on the setinfo endpoint due to improper sanitization of input used in a SQL UPDATE command. Exploitation can result in complete compromise of data integrity and availability within the affected system. The vulnerability is remotely exploitable without authentication or user interaction, making it highly critical. No official patch or fix has been documented yet, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation can cause total loss of integrity and availability of the affected mbCONNECT24 system's data. This means attackers could modify or disrupt data stored in the backend database, potentially causing system malfunction or data corruption. Confidentiality impact is not indicated. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the setinfo endpoint if possible and monitor for suspicious activity. Avoid exposing the vulnerable service to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.