This vulnerability (CVE-2026-40822) affects mbCONNECT24 by MB connect line. It is an SQL Injection issue classified under CWE-89, occurring in the DevSerialReset function. The flaw arises from improper neutralization of special elements in a SQL SELECT command, enabling a high privileged remote attacker to execute unauthorized SQL commands without authentication. The vulnerability can result in a total loss of confidentiality of the affected system. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality. No patch or official remediation level has been published as of the current data.

A high privileged remote attacker can exploit this unauthenticated SQL Injection vulnerability to gain unauthorized access to sensitive data, resulting in a total loss of confidentiality. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor MB connect line advisories for updates. Until a patch is available, restricting access to the affected function and applying compensating controls may reduce risk, but specific mitigations are not detailed in the current data.