CVE-2026-42416: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in AndonDesign UDesign Core

This vulnerability, identified as CVE-2026-42416 and classified under CWE-89, affects AndonDesign's UDesign Core product. It is a SQL Injection flaw present in versions up to 4.15.0, where special elements in SQL commands are not properly neutralized in the Subscriber component. The CVSS 3.1 base score is 8.5, indicating high severity, with an attack vector of network, low attack complexity, requiring low privileges and no user interaction. The impact scope is changed (S:C), with high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation could allow an attacker to access sensitive data (high confidentiality impact) without affecting data integrity but causing limited disruption to availability. The attack requires low privileges and no user interaction, making it relatively accessible to attackers with some access to the network.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable component and monitor for suspicious activity related to SQL injection attempts.