This vulnerability involves SQL injection in the Streamax Crocus product by Shenzhen Ruiming Technology, affecting all versions up to 1.3.44. The injection point is in the /RemoteFormat.do file's Endpoint component, specifically via the 'State' parameter. The flaw allows remote unauthenticated attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score is 6.9, indicating medium severity. The vendor has not issued any patch or advisory, and no official remediation is currently available.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, alteration, or deletion. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, organizations should consider implementing compensating controls such as input validation, web application firewalls (WAFs) to detect and block SQL injection attempts, and restricting access to the vulnerable endpoint where possible until an official patch is released.