This vulnerability (CVE-2026-40849) affects MB connect line's mbCONNECT24 product. It is an SQL Injection issue categorized under CWE-89, where special elements in a SQL SELECT command within the user_alarmprofile view are not properly neutralized. This flaw enables a low privileged remote attacker to perform unauthenticated SQL Injection attacks, potentially resulting in total loss of confidentiality of the affected system's data. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. No patch or official remediation guidance has been published by the vendor as of the current information.

The vulnerability allows unauthorized remote attackers with low privileges to execute SQL Injection attacks without authentication, leading to a total loss of confidentiality. This means sensitive data accessible via the user_alarmprofile view could be exposed or extracted by attackers. No information about integrity or availability impacts is provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor the vendor's communications for updates. Until a patch is available, restricting network access to the affected service and applying compensating controls to limit exposure may reduce risk.