This vulnerability (CVE-2026-40843) affects MB connect line's mbCONNECT24 product. It is caused by improper neutralization of special elements in a SQL SELECT command within the alarming view, enabling an unauthenticated, low privileged remote attacker to perform SQL Injection. This can result in unauthorized access to sensitive data, leading to a total loss of confidentiality. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. No vendor advisory or patch information is currently available.

An attacker exploiting this vulnerability can gain unauthorized access to sensitive information stored in the backend database of mbCONNECT24 by injecting malicious SQL commands. This results in a total loss of confidentiality of the affected system's data. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the alarming view and mbCONNECT24 interfaces to trusted networks and users only. Monitor vendor communications for updates on patches or mitigations.