This vulnerability (CVE-2026-40823) involves improper neutralization of special elements in an SQL UPDATE command within the DevSerialReset function of mbCONNECT24. A remote attacker with high privileges can exploit this unauthenticated SQL Injection flaw to read the entire database and alter data in a non-critical table. The vulnerability impacts confidentiality severely and integrity to a lesser extent. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality with limited impact on integrity. No official fix or patch has been disclosed by the vendor as of the publication date.

Successful exploitation allows an attacker to read the entire database, causing total loss of confidentiality. Additionally, the attacker can modify data in a non-critical table, resulting in some loss of data integrity. There is no indication of availability impact. The vulnerability requires high privileges but no user interaction and can be exploited remotely over the network.

No official patch or remediation is currently available from the vendor. Since the product is not a cloud service, remediation depends on vendor updates or workarounds. Organizations should monitor the vendor advisory for updates and apply any official fixes once released. Until then, restrict access to the affected function to trusted users and consider additional network-level protections to limit exposure.