This vulnerability (CVE-2026-40845) affects MB connect line's mbCONNECT24 product. It is caused by improper neutralization of special elements in an SQL SELECT command within the devices_configuration view, enabling unauthenticated SQL Injection by a low privileged remote attacker. This can result in unauthorized access to sensitive data, leading to a complete loss of confidentiality. The CVSS 4.0 base score is 7.1, indicating high severity. No patch or remediation level has been published, and the product is not a cloud service. The vulnerability was published on 2026-05-27.

An attacker exploiting this vulnerability can perform SQL Injection attacks without authentication, potentially accessing or extracting sensitive information from the database. This results in a total loss of confidentiality of the affected system's data. There is no indication of impact on integrity or availability in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected mbCONNECT24 interfaces to trusted networks and monitor for unusual activity related to SQL queries. Avoid exposing the devices_configuration view to untrusted users. Follow vendor updates closely for any forthcoming patches or mitigations.