An unauthenticated remote attacker can exploit an SQL Injection vulnerability in the getAccountData function of mbCONNECT24 due to improper neutralization of special elements in a SQL SELECT statement. This vulnerability allows execution of arbitrary SQL commands, risking complete confidentiality loss of the affected system's data. The vulnerability is identified as CWE-89 and has a CVSS 4.0 base score of 8.7, indicating high severity. No patch or official remediation has been published yet, and the product is not a cloud service.

Successful exploitation can lead to total loss of confidentiality of data managed by mbCONNECT24. Since the vulnerability is unauthenticated and remotely exploitable, an attacker can access sensitive information without any credentials. No known exploits are reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected service and monitor for unusual activity related to SQL queries targeting the getAccountData function. Avoid exposing mbCONNECT24 interfaces directly to untrusted networks.