This vulnerability involves improper neutralization of special elements in an SQL command within the getDeviceScalings function of mbCONNECT24, enabling unauthenticated SQL Injection attacks by low privileged remote attackers. The flaw allows attackers to manipulate SQL queries, potentially exposing sensitive data. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without affecting integrity or availability.

An attacker exploiting this vulnerability can achieve a total loss of confidentiality, meaning sensitive information stored or processed by the affected system can be disclosed. The vulnerability does not impact integrity or availability according to the CVSS vector. This could lead to unauthorized data exposure from the mbCONNECT24 system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting network access to the affected mbCONNECT24 service and monitor for unusual activity related to SQL injection attempts. Avoid exposing the vulnerable function to untrusted networks if possible.