CVE-2026-40825 describes an SQL Injection vulnerability (CWE-89) in MB connect line's mbCONNECT24 product. The flaw exists in the accountstatus view devices parameter, where special elements in a SQL UPDATE command are not properly neutralized. This allows a high privileged remote attacker to perform unauthenticated SQL Injection attacks, potentially reading the entire database and altering data in a non-critical table. The vulnerability leads to a total loss of confidentiality and some loss of integrity. The CVSS 4.0 score is 7.0 (high severity), with attack vector network, low attack complexity, no user interaction, and high confidentiality impact. No patch or official remediation guidance is currently available, and the product is not a cloud service.

The vulnerability allows a high privileged remote attacker to read the entire database and modify values in a non-critical table via unauthenticated SQL Injection. This results in total loss of confidentiality of the database contents and partial loss of data integrity. There is no indication of loss of availability or other impacts. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor MB connect line advisories for updates. Until a patch is available, restricting access to the vulnerable interface to trusted users and networks may reduce risk.